diff --git a/.github/scripts/cleanup-tags.py b/.github/scripts/cleanup-tags.py index 590344a2c..39d2f122e 100644 --- a/.github/scripts/cleanup-tags.py +++ b/.github/scripts/cleanup-tags.py @@ -7,6 +7,7 @@ import subprocess from argparse import ArgumentParser from typing import Dict from typing import Final +from typing import Iterator from typing import List from typing import Optional @@ -15,16 +16,17 @@ from github import ContainerPackage from github import GithubBranchApi from github import GithubContainerRegistryApi -import docker - logger = logging.getLogger("cleanup-tags") -class DockerManifest2: +class ImageProperties: """ - Data class wrapping the Docker Image Manifest Version 2. + Data class wrapping the properties of an entry in the image index + manifests list. It is NOT an actual image with layers, etc - See https://docs.docker.com/registry/spec/manifest-v2-2/ + https://docs.docker.com/registry/spec/manifest-v2-2/ + https://github.com/opencontainers/image-spec/blob/main/manifest.md + https://github.com/opencontainers/image-spec/blob/main/descriptor.md """ def __init__(self, data: Dict) -> None: @@ -41,6 +43,45 @@ class DockerManifest2: self.platform = f"{platform_data_os}/{platform_arch}{platform_variant}" +class ImageIndex: + """ + Data class wrapping up logic for an OCI Image Index + JSON data. Primary use is to access the manifests listing + + See https://github.com/opencontainers/image-spec/blob/main/image-index.md + """ + + def __init__(self, package_url: str, tag: str) -> None: + self.qualified_name = f"{package_url}:{tag}" + logger.info(f"Getting image index for {self.qualified_name}") + try: + proc = subprocess.run( + [ + shutil.which("docker"), + "buildx", + "imagetools", + "inspect", + "--raw", + self.qualified_name, + ], + capture_output=True, + check=True, + ) + + self._data = json.loads(proc.stdout) + + except subprocess.CalledProcessError as e: + logger.error( + f"Failed to get image index for {self.qualified_name}: {e.stderr}", + ) + raise e + + @property + def image_pointers(self) -> Iterator[ImageProperties]: + for manifest_data in self._data["manifests"]: + yield ImageProperties(manifest_data) + + class RegistryTagsCleaner: """ This is the base class for the image registry cleaning. Given a package @@ -87,7 +128,10 @@ class RegistryTagsCleaner: def clean(self): """ - This method will delete image versions, based on the selected tags to delete + This method will delete image versions, based on the selected tags to delete. + It behaves more like an unlinking than actual deletion. Removing the tag + simply removes a pointer to an image, but the actual image data remains accessible + if one has the sha256 digest of it. """ for tag_to_delete in self.tags_to_delete: package_version_info = self.all_pkgs_tags_to_version[tag_to_delete] @@ -151,31 +195,17 @@ class RegistryTagsCleaner: # Parse manifests to locate digests pointed to for tag in sorted(self.tags_to_keep): - full_name = f"ghcr.io/{self.repo_owner}/{self.package_name}:{tag}" - logger.info(f"Checking manifest for {full_name}") - # TODO: It would be nice to use RegistryData from docker - # except the ID doesn't map to anything in the manifest try: - proc = subprocess.run( - [ - shutil.which("docker"), - "buildx", - "imagetools", - "inspect", - "--raw", - full_name, - ], - capture_output=True, + image_index = ImageIndex( + f"ghcr.io/{self.repo_owner}/{self.package_name}", + tag, ) - - manifest_list = json.loads(proc.stdout) - for manifest_data in manifest_list["manifests"]: - manifest = DockerManifest2(manifest_data) + for manifest in image_index.image_pointers: if manifest.digest in untagged_versions: logger.info( f"Skipping deletion of {manifest.digest}," - f" referred to by {full_name}" + f" referred to by {image_index.qualified_name}" f" for {manifest.platform}", ) del untagged_versions[manifest.digest] @@ -247,64 +277,54 @@ class RegistryTagsCleaner: # By default, keep anything which is tagged self.tags_to_keep = list(set(self.all_pkgs_tags_to_version.keys())) - def check_tags_pull(self): + def check_remaining_tags_valid(self): """ - This method uses the Docker Python SDK to confirm all tags which were - kept still pull, for all platforms. + Checks the non-deleted tags are still valid. The assumption is if the + manifest is can be inspected and each image manifest if points to can be + inspected, the image will still pull. - TODO: This is much slower (although more comprehensive). Maybe a Pool? + https://github.com/opencontainers/image-spec/blob/main/image-index.md """ logger.info("Beginning confirmation step") - client = docker.from_env() - imgs = [] + a_tag_failed = False for tag in sorted(self.tags_to_keep): - repository = f"ghcr.io/{self.repo_owner}/{self.package_name}" - for arch, variant in [("amd64", None), ("arm64", None), ("arm", "v7")]: - # From 11.2.0 onwards, qpdf is cross compiled, so there is a single arch, amd64 - # skip others in this case - if "qpdf" in self.package_name and arch != "amd64" and tag == "11.2.0": - continue - # Skip beta and release candidate tags - elif "beta" in tag: - continue - # Build the platform name - if variant is not None: - platform = f"linux/{arch}/{variant}" - else: - platform = f"linux/{arch}" + try: + image_index = ImageIndex( + f"ghcr.io/{self.repo_owner}/{self.package_name}", + tag, + ) + for manifest in image_index.image_pointers: + logger.info(f"Checking {manifest.digest} for {manifest.platform}") - try: - logger.info(f"Pulling {repository}:{tag} for {platform}") - image = client.images.pull( - repository=repository, - tag=tag, - platform=platform, - ) - imgs.append(image) - except docker.errors.APIError as e: - logger.error( - f"Failed to pull {repository}:{tag}: {e}", - ) + # This follows the pointer from the index to an actual image, layers and all + # Note the format is @ + digest_name = f"ghcr.io/{self.repo_owner}/{self.package_name}@{manifest.digest}" - # Prevent out of space errors by removing after a few - # pulls - if len(imgs) > 50: - for image in imgs: try: - client.images.remove(image.id) - except docker.errors.APIError as e: - err_str = str(e) - # Ignore attempts to remove images that are partly shared - # Ignore images which are somehow gone already - if ( - "must be forced" not in err_str - and "No such image" not in err_str - ): - logger.error( - f"Remove image ghcr.io/{self.repo_owner}/{self.package_name}:{tag} failed: {e}", - ) - imgs = [] + + subprocess.run( + [ + shutil.which("docker"), + "buildx", + "imagetools", + "inspect", + "--raw", + digest_name, + ], + capture_output=True, + check=True, + ) + except subprocess.CalledProcessError as e: + logger.error(f"Failed to inspect digest: {e.stderr}") + a_tag_failed = True + except subprocess.CalledProcessError as e: + a_tag_failed = True + logger.error(f"Failed to inspect: {e.stderr}") + continue + + if a_tag_failed: + raise Exception("At least one image tag failed to inspect") class MainImageTagsCleaner(RegistryTagsCleaner): @@ -366,7 +386,7 @@ class MainImageTagsCleaner(RegistryTagsCleaner): class LibraryTagsCleaner(RegistryTagsCleaner): """ - Exists for the off change that someday, the installer library images + Exists for the off chance that someday, the installer library images will need their own logic """ @@ -464,7 +484,7 @@ def _main(): # Verify remaining tags still pull if args.is_manifest: - cleaner.check_tags_pull() + cleaner.check_remaining_tags_valid() if __name__ == "__main__": diff --git a/Pipfile b/Pipfile index 09065956b..b425fe2c1 100644 --- a/Pipfile +++ b/Pipfile @@ -16,6 +16,7 @@ django-compression-middleware = "*" django-extensions = "*" django-filter = "~=22.1" djangorestframework = "~=3.14" +django-ipware = "*" filelock = "*" gunicorn = "*" imap-tools = "*" @@ -61,11 +62,15 @@ bleach = "*" scipy = "==1.8.1" # Newer versions aren't builting yet (see https://www.piwheels.org/project/cryptography/) cryptography = "==38.0.1" +django-guardian = "*" +djangorestframework-guardian = "*" + # Locked version until https://github.com/django/channels_redis/issues/332 # is resolved channels-redis = "==3.4.1" + [dev-packages] coveralls = "*" factory-boy = "*" diff --git a/Pipfile.lock b/Pipfile.lock index a161f9d82..14237a002 100644 --- a/Pipfile.lock +++ b/Pipfile.lock @@ -1,7 +1,7 @@ { "_meta": { "hash": { - "sha256": "d70848276d3ac35fa361c15ac2d634344cdb08618790502669eee209fc16fa00" + "sha256": "0e1a26c5e9acb1d745f951f92d00d60272f83406467d90551e558972697b53cd" }, "pipfile-spec": 6, "requires": {}, @@ -313,7 +313,7 @@ "sha256:5a3d016c7c547f69d6f81fb0db9449ce888b418b5b9952cc5e6e66843e9dd845", "sha256:83e9a75d1911279afd89352c68b45348559d1fc0506b054b346651b5e7fee29f" ], - "markers": "python_full_version >= '3.6.0'", + "markers": "python_version >= '3.6'", "version": "==2.1.1" }, "click": { @@ -329,7 +329,7 @@ "sha256:a0713dc7a1de3f06bc0df5a9567ad19ead2d3d5689b434768a6145bff77c0667", "sha256:f184f0d851d96b6d29297354ed981b7dd71df7ff500d82fa6d11f0856bee8035" ], - "markers": "python_full_version >= '3.6.2' and python_full_version < '4.0.0'", + "markers": "python_version < '4' and python_full_version >= '3.6.2'", "version": "==0.3.0" }, "click-plugins": { @@ -472,6 +472,22 @@ "index": "pypi", "version": "==22.1" }, + "django-guardian": { + "hashes": [ + "sha256:440ca61358427e575323648b25f8384739e54c38b3d655c81d75e0cd0d61b697", + "sha256:c58a68ae76922d33e6bdc0e69af1892097838de56e93e78a8361090bcd9f89a0" + ], + "index": "pypi", + "version": "==2.4.0" + }, + "django-ipware": { + "hashes": [ + "sha256:602a58325a4808bd19197fef2676a0b2da2df40d0ecf21be414b2ff48c72ad05", + "sha256:878dbb06a87e25550798e9ef3204ed70a200dd8b15e47dcef848cf08244f04c9" + ], + "index": "pypi", + "version": "==4.0.2" + }, "djangorestframework": { "hashes": [ "sha256:579a333e6256b09489cbe0a067e66abe55c6595d8926be6b99423786334350c8", @@ -480,6 +496,14 @@ "index": "pypi", "version": "==3.14.0" }, + "djangorestframework-guardian": { + "hashes": [ + "sha256:1883756452d9bfcc2a51fb4e039a6837a8f6697c756447aa83af085749b59330", + "sha256:3bd3dd6ea58e1bceca5048faf6f8b1a93bb5dcff30ba5eb91b9a0e190a48a0c7" + ], + "index": "pypi", + "version": "==0.3.0" + }, "filelock": { "hashes": [ "sha256:7b319f24340b51f55a2bf7a12ac0755a9b03e718311dac567a0f4f7fabd2f5de", @@ -2205,7 +2229,7 @@ "sha256:5a3d016c7c547f69d6f81fb0db9449ce888b418b5b9952cc5e6e66843e9dd845", "sha256:83e9a75d1911279afd89352c68b45348559d1fc0506b054b346651b5e7fee29f" ], - "markers": "python_full_version >= '3.6.0'", + "markers": "python_version >= '3.6'", "version": "==2.1.1" }, "click": { @@ -2401,7 +2425,7 @@ "sha256:cbb516f16218e643d8e0a95b309f77eb118cb138d39a4f27851e6a63581db874", "sha256:f5da449a6e1c989a4cea2631aa8ee67caa5a2ef855d551c88f9e309f4634c621" ], - "markers": "python_version >= '3.6'", + "markers": "python_full_version >= '3.6.0'", "version": "==3.3.7" }, "markupsafe": { @@ -2455,7 +2479,7 @@ "sha256:0096d52e9dad9939c3d975a774666af186eda617e6ca84df4c94dec30004f2a8", "sha256:70775750742b25c0d8f36c55aed03d24c3384d17c951b3175d898bd778ef0307" ], - "markers": "python_version >= '3.6'", + "markers": "python_full_version >= '3.6.0'", "version": "==1.3.4" }, "mkdocs": { @@ -2800,7 +2824,7 @@ "sha256:70092675bda14fdec33b31ba77e7543de9ddc88f2e5b99160396572d11525bdb", "sha256:af31106dec8a4d68c60207c1886031cbf839b68aa7abccdb19868200532c2069" ], - "markers": "python_version >= '3.6'", + "markers": "python_full_version >= '3.6.0'", "version": "==0.1" }, "regex": { @@ -2987,7 +3011,7 @@ "sha256:ce3b1684d6e1a20a3e5ed36795a97dfc6af29bc3970ca8dab93e11ac6094b3c4", "sha256:f8b927684efc6f1cc206c9db297a570ab9ad0e51c16fa9e45487d36d1905c058" ], - "markers": "python_version >= '3.6'", + "markers": "python_full_version >= '3.6.0'", "version": "==20.17.1" }, "watchdog": { diff --git a/docker/compose/docker-compose.ci-test.yml b/docker/compose/docker-compose.ci-test.yml index b1b8d2179..99f0ee90e 100644 --- a/docker/compose/docker-compose.ci-test.yml +++ b/docker/compose/docker-compose.ci-test.yml @@ -6,7 +6,7 @@ version: "3.7" services: gotenberg: - image: docker.io/gotenberg/gotenberg:7.6 + image: docker.io/gotenberg/gotenberg:7.8 hostname: gotenberg container_name: gotenberg network_mode: host diff --git a/docker/compose/docker-compose.mariadb-tika.yml b/docker/compose/docker-compose.mariadb-tika.yml index 4cd9f71b0..1b39c254c 100644 --- a/docker/compose/docker-compose.mariadb-tika.yml +++ b/docker/compose/docker-compose.mariadb-tika.yml @@ -83,7 +83,7 @@ services: PAPERLESS_TIKA_ENDPOINT: http://tika:9998 gotenberg: - image: docker.io/gotenberg/gotenberg:7.6 + image: docker.io/gotenberg/gotenberg:7.8 restart: unless-stopped # The gotenberg chromium route is used to convert .eml files. We do not # want to allow external content like tracking pixels or even javascript. diff --git a/docker/compose/docker-compose.postgres-tika.yml b/docker/compose/docker-compose.postgres-tika.yml index c67fb47d0..a451b00dd 100644 --- a/docker/compose/docker-compose.postgres-tika.yml +++ b/docker/compose/docker-compose.postgres-tika.yml @@ -77,7 +77,7 @@ services: PAPERLESS_TIKA_ENDPOINT: http://tika:9998 gotenberg: - image: docker.io/gotenberg/gotenberg:7.6 + image: docker.io/gotenberg/gotenberg:7.8 restart: unless-stopped # The gotenberg chromium route is used to convert .eml files. We do not diff --git a/docker/compose/docker-compose.sqlite-tika.yml b/docker/compose/docker-compose.sqlite-tika.yml index 40d6d93a8..909dafe5b 100644 --- a/docker/compose/docker-compose.sqlite-tika.yml +++ b/docker/compose/docker-compose.sqlite-tika.yml @@ -65,7 +65,7 @@ services: PAPERLESS_TIKA_ENDPOINT: http://tika:9998 gotenberg: - image: docker.io/gotenberg/gotenberg:7.6 + image: docker.io/gotenberg/gotenberg:7.8 restart: unless-stopped # The gotenberg chromium route is used to convert .eml files. We do not diff --git a/docs/advanced_usage.md b/docs/advanced_usage.md index 9a1abcfff..cd82ab78e 100644 --- a/docs/advanced_usage.md +++ b/docs/advanced_usage.md @@ -414,13 +414,6 @@ structure as in the previous example above. Defining a storage path is optional. If no storage path is defined for a document, the global `PAPERLESS_FILENAME_FORMAT` is applied. -!!! warning - - If you adjust the format of an existing storage path, old documents - don't get relocated automatically. You need to run the - [document renamer](/administration#renamer) to - adjust their paths. - ## Celery Monitoring {#celery-monitoring} The monitoring tool @@ -501,3 +494,9 @@ You can also set the default for new tables (this does NOT affect existing tables) with: `ALTER DATABASE CHARACTER SET utf8mb4 COLLATE utf8mb4_bin;` + +!!! warning + + Using mariadb version 10.4+ is recommended. Using the `utf8mb3` character set on + an older system may fix issues that can arise while setting up Paperless-ngx but + `utf8mb3` can cause issues with consumption (where `utf8mb4` does not). diff --git a/docs/api.md b/docs/api.md index 2c200dea7..2ed1cbce8 100644 --- a/docs/api.md +++ b/docs/api.md @@ -16,6 +16,8 @@ The API provides 7 main endpoints: - `/api/tags/`: Full CRUD support. - `/api/mail_accounts/`: Full CRUD support. - `/api/mail_rules/`: Full CRUD support. +- `/api/users/`: Full CRUD support. +- `/api/groups/`: Full CRUD support. All of these endpoints except for the logging endpoint allow you to fetch, edit and delete individual objects by appending their primary key @@ -254,6 +256,7 @@ The endpoint supports the following optional form fields: - `document_type`: Similar to correspondent. - `tags`: Similar to correspondent. Specify this multiple times to have multiple tags added to the document. +- `owner`: An optional user ID to set as the owner. The endpoint will immediately return "OK" if the document consumption process was started successfully. No additional status information about diff --git a/docs/changelog.md b/docs/changelog.md index 5a9371781..50e8015a8 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -1,12 +1,83 @@ # Changelog -## paperless-ngx 1.12.1 +## paperless-ngx 1.13.0 + +### Features + +- Feature: allow disable warn on close saved view with changes [@shamoon](https://github.com/shamoon) ([#2681](https://github.com/paperless-ngx/paperless-ngx/pull/2681)) +- Feature: Add option to enable response compression [@stumpylog](https://github.com/stumpylog) ([#2621](https://github.com/paperless-ngx/paperless-ngx/pull/2621)) +- Feature: split documents on ASN barcode [@muued](https://github.com/muued) ([#2554](https://github.com/paperless-ngx/paperless-ngx/pull/2554)) + +### Bug Fixes + +- Fix: Ignore path filtering didn't handle sub directories [@stumpylog](https://github.com/stumpylog) ([#2674](https://github.com/paperless-ngx/paperless-ngx/pull/2674)) +- Bugfix: Generation of secret key hangs during install script [@stumpylog](https://github.com/stumpylog) ([#2657](https://github.com/paperless-ngx/paperless-ngx/pull/2657)) +- Fix: Remove files produced by barcode splitting when completed [@stumpylog](https://github.com/stumpylog) ([#2648](https://github.com/paperless-ngx/paperless-ngx/pull/2648)) +- Fix: add missing storage path placeholders [@shamoon](https://github.com/shamoon) ([#2651](https://github.com/paperless-ngx/paperless-ngx/pull/2651)) +- Fix long dropdown contents break document detail column view [@shamoon](https://github.com/shamoon) ([#2638](https://github.com/paperless-ngx/paperless-ngx/pull/2638)) +- Fix: tags dropdown should stay closed when removing [@shamoon](https://github.com/shamoon) ([#2625](https://github.com/paperless-ngx/paperless-ngx/pull/2625)) +- Bugfix: Configure scheduled tasks to expire after some time [@stumpylog](https://github.com/stumpylog) ([#2614](https://github.com/paperless-ngx/paperless-ngx/pull/2614)) +- Bugfix: Limit management list pagination maxSize to 5 [@Kaaybi](https://github.com/Kaaybi) ([#2618](https://github.com/paperless-ngx/paperless-ngx/pull/2618)) +- Fix: Don't crash on bad ASNs during indexing [@stumpylog](https://github.com/stumpylog) ([#2586](https://github.com/paperless-ngx/paperless-ngx/pull/2586)) +- Fix: Prevent mktime OverflowError except in even more rare caes [@stumpylog](https://github.com/stumpylog) ([#2574](https://github.com/paperless-ngx/paperless-ngx/pull/2574)) +- Bugfix: Whoosh relative date queries weren't handling timezones [@stumpylog](https://github.com/stumpylog) ([#2566](https://github.com/paperless-ngx/paperless-ngx/pull/2566)) +- Fix importing files with non-ascii names [@Kexogg](https://github.com/Kexogg) ([#2555](https://github.com/paperless-ngx/paperless-ngx/pull/2555)) + +### Documentation + +- Chore: update recommended Gotenberg to 7.8, docs note possible incompatibility [@shamoon](https://github.com/shamoon) ([#2608](https://github.com/paperless-ngx/paperless-ngx/pull/2608)) +- [Documentation] Add v1.12.2 changelog [@github-actions](https://github.com/github-actions) ([#2553](https://github.com/paperless-ngx/paperless-ngx/pull/2553)) + +### Maintenance + +- Chore: Faster Docker image cleanup [@stumpylog](https://github.com/stumpylog) ([#2687](https://github.com/paperless-ngx/paperless-ngx/pull/2687)) +- Chore: Remove duplicated folder [@stumpylog](https://github.com/stumpylog) ([#2561](https://github.com/paperless-ngx/paperless-ngx/pull/2561)) +- Chore: Switch test coverage to Codecov [@stumpylog](https://github.com/stumpylog) ([#2582](https://github.com/paperless-ngx/paperless-ngx/pull/2582)) +- Bump docker/build-push-action from 3 to 4 [@dependabot](https://github.com/dependabot) ([#2576](https://github.com/paperless-ngx/paperless-ngx/pull/2576)) +- Chore: Run tests which require convert in the CI [@stumpylog](https://github.com/stumpylog) ([#2570](https://github.com/paperless-ngx/paperless-ngx/pull/2570)) + +- Feature: split documents on ASN barcode [@muued](https://github.com/muued) ([#2554](https://github.com/paperless-ngx/paperless-ngx/pull/2554)) +- Bugfix: Whoosh relative date queries weren't handling timezones [@stumpylog](https://github.com/stumpylog) ([#2566](https://github.com/paperless-ngx/paperless-ngx/pull/2566)) +- Fix importing files with non-ascii names [@Kexogg](https://github.com/Kexogg) ([#2555](https://github.com/paperless-ngx/paperless-ngx/pull/2555)) + +## paperless-ngx 1.12.2 _Note: Version 1.12.x introduced searching of comments which will work for comments added after the upgrade but a reindex of the search index is required in order to be able to search older comments. The Docker image will automatically perform this reindex, bare metal installations will have to perform this manually, see [the docs](https://docs.paperless-ngx.com/administration/#index)._ ### Bug Fixes +- Bugfix: Allow pre-consume scripts to modify incoming file [@stumpylog](https://github.com/stumpylog) ([#2547](https://github.com/paperless-ngx/paperless-ngx/pull/2547)) +- Bugfix: Return to page based barcode scanning [@stumpylog](https://github.com/stumpylog) ([#2544](https://github.com/paperless-ngx/paperless-ngx/pull/2544)) +- Fix: Try to prevent title debounce overwriting [@shamoon](https://github.com/shamoon) ([#2543](https://github.com/paperless-ngx/paperless-ngx/pull/2543)) +- Fix comment search highlight + multi-word search [@shamoon](https://github.com/shamoon) ([#2542](https://github.com/paperless-ngx/paperless-ngx/pull/2542)) +- Bugfix: Request PDF/A format from Gotenberg [@stumpylog](https://github.com/stumpylog) ([#2530](https://github.com/paperless-ngx/paperless-ngx/pull/2530)) +- Fix: Trigger reindex for pre-existing comments [@shamoon](https://github.com/shamoon) ([#2519](https://github.com/paperless-ngx/paperless-ngx/pull/2519)) + +### Documentation + +- Bugfix: Allow pre-consume scripts to modify incoming file [@stumpylog](https://github.com/stumpylog) ([#2547](https://github.com/paperless-ngx/paperless-ngx/pull/2547)) +- Fix: Trigger reindex for pre-existing comments [@shamoon](https://github.com/shamoon) ([#2519](https://github.com/paperless-ngx/paperless-ngx/pull/2519)) +- Minor updates to development documentation [@clemensrieder](https://github.com/clemensrieder) ([#2474](https://github.com/paperless-ngx/paperless-ngx/pull/2474)) +- [Documentation] Add v1.12.1 changelog [@github-actions](https://github.com/github-actions) ([#2515](https://github.com/paperless-ngx/paperless-ngx/pull/2515)) + +### Maintenance + +- Chore: Fix tag cleaner to work with attestations [@stumpylog](https://github.com/stumpylog) ([#2532](https://github.com/paperless-ngx/paperless-ngx/pull/2532)) +- Chore: Make installers statically versioned [@stumpylog](https://github.com/stumpylog) ([#2517](https://github.com/paperless-ngx/paperless-ngx/pull/2517)) + +### All App Changes + +- Bugfix: Allow pre-consume scripts to modify incoming file [@stumpylog](https://github.com/stumpylog) ([#2547](https://github.com/paperless-ngx/paperless-ngx/pull/2547)) +- Bugfix: Return to page based barcode scanning [@stumpylog](https://github.com/stumpylog) ([#2544](https://github.com/paperless-ngx/paperless-ngx/pull/2544)) +- Fix: Try to prevent title debounce overwriting [@shamoon](https://github.com/shamoon) ([#2543](https://github.com/paperless-ngx/paperless-ngx/pull/2543)) +- Fix comment search highlight + multi-word search [@shamoon](https://github.com/shamoon) ([#2542](https://github.com/paperless-ngx/paperless-ngx/pull/2542)) +- Bugfix: Request PDF/A format from Gotenberg [@stumpylog](https://github.com/stumpylog) ([#2530](https://github.com/paperless-ngx/paperless-ngx/pull/2530)) + +## paperless-ngx 1.12.1 + +### Bug Fixes + - Fix: comments not showing in search until after manual reindex in v1.12 [@shamoon](https://github.com/shamoon) ([#2513](https://github.com/paperless-ngx/paperless-ngx/pull/2513)) - Fix: date range search broken in 1.12 [@shamoon](https://github.com/shamoon) ([#2509](https://github.com/paperless-ngx/paperless-ngx/pull/2509)) diff --git a/docs/configuration.md b/docs/configuration.md index 27b3f1b28..6c233c2e6 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -262,6 +262,14 @@ do CORS calls. Set this to your public domain name. Defaults to "". +`PAPERLESS_TRUSTED_PROXIES=` + +: This may be needed to prevent IP address spoofing if you are using e.g. +fail2ban with log entries for failed authorization attempts. Value should be +IP address(es). + + Defaults to empty string. + `PAPERLESS_FORCE_SCRIPT_NAME=` : To host paperless under a subpath url like example.com/paperless you @@ -626,7 +634,7 @@ services: # ... gotenberg: - image: gotenberg/gotenberg:7.6 + image: gotenberg/gotenberg:7.8 restart: unless-stopped # The gotenberg chromium route is used to convert .eml files. We do not # want to allow external content like tracking pixels or even javascript. @@ -999,13 +1007,20 @@ within your documents. `PAPERLESS_CONSUMER_IGNORE_PATTERNS=` : By default, paperless ignores certain files and folders in the -consumption directory, such as system files created by the Mac OS. +consumption directory, such as system files created by the Mac OS +or hidden folders some tools use to store data. This can be adjusted by configuring a custom json array with patterns to exclude. + For example, `.DS_STORE/*` will ignore any files found in a folder + named `.DS_STORE`, including `.DS_STORE/bar.pdf` and `foo/.DS_STORE/bar.pdf` + + A pattern like `._*` will ignore anything starting with `._`, including: + `._foo.pdf` and `._bar/foo.pdf` + Defaults to - `[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini"]`. + `[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini", "@eaDir/*"]`. ## Binaries diff --git a/docs/development.md b/docs/development.md index d39261e23..13ef91f83 100644 --- a/docs/development.md +++ b/docs/development.md @@ -251,7 +251,7 @@ these parts have to be translated separately. - The translated strings need to be placed in the `src-ui/src/locale/` folder. - In order to extract added or changed strings from the source files, - call `ng xi18n --ivy`. + call `ng extract-i18n`. Adding new languages requires adding the translated files in the `src-ui/src/locale/` folder and adjusting a couple files. diff --git a/docs/setup.md b/docs/setup.md index 391ef7850..7eaaf69f7 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -708,6 +708,12 @@ below use PostgreSQL, but are applicable to MySQL/MariaDB with the MySQL also enforces limits on maximum lengths, but does so differently than PostgreSQL. It may not be possible to migrate to MySQL due to this. +!!! warning + + Using mariadb version 10.4+ is recommended. Using the `utf8mb3` character set on + an older system may fix issues that can arise while setting up Paperless-ngx but + `utf8mb3` can cause issues with consumption (where `utf8mb4` does not). + 1. Stop paperless, if it is running. 2. Tell paperless to use PostgreSQL: diff --git a/docs/usage.md b/docs/usage.md index 6a0277d45..e162e6e3a 100644 --- a/docs/usage.md +++ b/docs/usage.md @@ -202,6 +202,39 @@ configured via `PAPERLESS_EMAIL_TASK_CRON` (see [software tweaks](/configuration You can also submit a document using the REST API, see [POSTing documents](/api#file-uploads) for details. +## Permissions + +As of version 1.13.0 Paperless-ngx added core support for user / group permissions. Permissions is +based around an object 'owner' and 'view' and 'edit' permissions can be granted to other users +or groups. + +Permissions uses the built-in user model of the backend framework, Django. + +!!! note + + After migration to version 1.13.0 all existing documents, tags etc. will have no explicit owner + set which means they will be visible / editable by all users. Once an object has an owner set, + only the owner can explicitly grant / revoke permissions. + +!!! note + + When first migrating to permissions it is recommended to user a 'superuser' account (which + would usually have been setup during installation) to ensure you have full permissions. + + Note that superusers have access to all objects. + +Permissions can be set using the new "Permissions" tab when editing documents, or bulk-applied +in the UI by selecting documents and choosing the "Permissions" button. Owner can also optionally +be set for documents uploaded via the API. Documents consumed via the consumption dir currently +do not have an owner set. + +### Users and Groups + +Paperless-ngx versions after 1.13.0 allow creating and editing users and groups via the 'frontend' UI. +These can be found under Settings > Users & Groups, assuming the user has access. If a user is designated +as a member of a group those permissions will be inherited and this is reflected in the UI. Explicit +permissions can be granted to limit access to certain parts of the UI (and corresponding API endpoints). + ## Best practices {#basic-searching} Paperless offers a couple tools that help you organize your document diff --git a/install-paperless-ngx.sh b/install-paperless-ngx.sh index c05a4b36c..469f96005 100755 --- a/install-paperless-ngx.sh +++ b/install-paperless-ngx.sh @@ -321,7 +321,7 @@ fi wget "https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docker/compose/docker-compose.$DOCKER_COMPOSE_VERSION.yml" -O docker-compose.yml wget "https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/docker/compose/.env" -O .env -SECRET_KEY=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 64 | head -n 1) +SECRET_KEY=$(tr --delete --complement 'a-zA-Z0-9' < /dev/urandom 2>/dev/null | head --bytes 64) DEFAULT_LANGUAGES=("deu eng fra ita spa") diff --git a/scripts/start_services.sh b/scripts/start_services.sh index d53698a27..503755c0e 100755 --- a/scripts/start_services.sh +++ b/scripts/start_services.sh @@ -2,5 +2,5 @@ docker run -p 5432:5432 -e POSTGRES_PASSWORD=password -v paperless_pgdata:/var/lib/postgresql/data -d postgres:13 docker run -d -p 6379:6379 redis:latest -docker run -p 3000:3000 -d gotenberg/gotenberg:7.6 gotenberg --chromium-disable-javascript=true --chromium-allow-list="file:///tmp/.*" +docker run -p 3000:3000 -d gotenberg/gotenberg:7.8 gotenberg --chromium-disable-javascript=true --chromium-allow-list="file:///tmp/.*" docker run -p 9998:9998 -d ghcr.io/paperless-ngx/tika:latest diff --git a/src-ui/cypress/e2e/auth/auth.cy.ts b/src-ui/cypress/e2e/auth/auth.cy.ts new file mode 100644 index 000000000..717113c76 --- /dev/null +++ b/src-ui/cypress/e2e/auth/auth.cy.ts @@ -0,0 +1,68 @@ +describe('settings', () => { + beforeEach(() => { + // also uses global fixtures from cypress/support/e2e.ts + + // mock restricted permissions + cy.intercept('http://localhost:8000/api/ui_settings/', { + fixture: 'ui_settings/settings_restricted.json', + }) + }) + + it('should not allow user to edit settings', () => { + cy.visit('/dashboard') + cy.contains('Settings').should('not.exist') + cy.visit('/settings').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + }) + + it('should not allow user to view documents', () => { + cy.visit('/dashboard') + cy.contains('Documents').should('not.exist') + cy.visit('/documents').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + cy.visit('/documents/1').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + }) + + it('should not allow user to view correspondents', () => { + cy.visit('/dashboard') + cy.contains('Correspondents').should('not.exist') + cy.visit('/correspondents').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + }) + + it('should not allow user to view tags', () => { + cy.visit('/dashboard') + cy.contains('Tags').should('not.exist') + cy.visit('/tags').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + }) + + it('should not allow user to view document types', () => { + cy.visit('/dashboard') + cy.contains('Document Types').should('not.exist') + cy.visit('/documenttypes').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + }) + + it('should not allow user to view storage paths', () => { + cy.visit('/dashboard') + cy.contains('Storage Paths').should('not.exist') + cy.visit('/storagepaths').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + }) + + it('should not allow user to view logs', () => { + cy.visit('/dashboard') + cy.contains('Logs').should('not.exist') + cy.visit('/logs').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + }) + + it('should not allow user to view tasks', () => { + cy.visit('/dashboard') + cy.contains('Tasks').should('not.exist') + cy.visit('/tasks').wait(2000) + cy.contains("You don't have permissions to do that").should('exist') + }) +}) diff --git a/src-ui/cypress/fixtures/documents/1/comments.json b/src-ui/cypress/fixtures/documents/1/comments.json index 73e932187..a6013b513 100644 --- a/src-ui/cypress/fixtures/documents/1/comments.json +++ b/src-ui/cypress/fixtures/documents/1/comments.json @@ -6,8 +6,8 @@ "user": { "id": 1, "username": "user2", - "firstname": "", - "lastname": "" + "first_name": "", + "last_name": "" } }, { @@ -17,8 +17,8 @@ "user": { "id": 2, "username": "user1", - "firstname": "", - "lastname": "" + "first_name": "", + "last_name": "" } }, { @@ -28,8 +28,8 @@ "user": { "id": 2, "username": "user33", - "firstname": "", - "lastname": "" + "first_name": "", + "last_name": "" } }, { @@ -39,8 +39,8 @@ "user": { "id": 3, "username": "admin", - "firstname": "", - "lastname": "" + "first_name": "", + "last_name": "" } } ] diff --git a/src-ui/cypress/fixtures/documents/documents.json b/src-ui/cypress/fixtures/documents/documents.json index bcf122ecc..211401b4b 100644 --- a/src-ui/cypress/fixtures/documents/documents.json +++ b/src-ui/cypress/fixtures/documents/documents.json @@ -14,11 +14,14 @@ 4 ], "created": "2022-03-22T07:24:18Z", + "created_date": "2022-03-22", "modified": "2022-03-22T07:24:23.264859Z", "added": "2022-03-22T07:24:22.922631Z", "archive_serial_number": null, "original_file_name": "2022-03-22 no latin title.pdf", - "archived_file_name": "2022-03-22 no latin title.pdf" + "archived_file_name": "2022-03-22 no latin title.pdf", + "owner": null, + "permissions": [] }, { "id": 2, @@ -29,11 +32,14 @@ "content": "Test document PDF", "tags": [], "created": "2022-03-23T07:24:18Z", + "created_date": "2022-03-23", "modified": "2022-03-23T07:24:23.264859Z", "added": "2022-03-23T07:24:22.922631Z", "archive_serial_number": 12345, "original_file_name": "2022-03-23 lorem ipsum dolor sit amet.pdf", - "archived_file_name": "2022-03-23 llorem ipsum dolor sit amet.pdf" + "archived_file_name": "2022-03-23 llorem ipsum dolor sit amet.pdf", + "owner": null, + "permissions": [] }, { "id": 3, @@ -46,11 +52,14 @@ 2 ], "created": "2022-03-24T07:24:18Z", + "created_date": "2022-03-24", "modified": "2022-03-24T07:24:23.264859Z", "added": "2022-03-24T07:24:22.922631Z", "archive_serial_number": null, "original_file_name": "2022-03-24 dolor.pdf", - "archived_file_name": "2022-03-24 dolor.pdf" + "archived_file_name": "2022-03-24 dolor.pdf", + "owner": null, + "permissions": [] }, { "id": 4, @@ -63,11 +72,14 @@ 4, 5 ], "created": "2022-06-01T07:24:18Z", + "created_date": "2022-06-01", "modified": "2022-06-01T07:24:23.264859Z", "added": "2022-06-01T07:24:22.922631Z", "archive_serial_number": 12347, "original_file_name": "2022-06-01 sit amet.pdf", - "archived_file_name": "2022-06-01 sit amet.pdf" + "archived_file_name": "2022-06-01 sit amet.pdf", + "owner": null, + "permissions": [] } ] } diff --git a/src-ui/cypress/fixtures/groups/groups.json b/src-ui/cypress/fixtures/groups/groups.json new file mode 100644 index 000000000..0bf2655d9 --- /dev/null +++ b/src-ui/cypress/fixtures/groups/groups.json @@ -0,0 +1,119 @@ +{ + "count": 2, + "next": null, + "previous": null, + "results": [ + { + "id": 6, + "name": "Another Group", + "permissions": [ + "add_user", + "change_user", + "delete_user", + "view_user", + "add_comment", + "change_comment", + "delete_comment", + "view_comment" + ] + }, + { + "id": 1, + "name": "First Group", + "permissions": [ + "add_group", + "change_group", + "delete_group", + "view_group", + "add_permission", + "change_permission", + "delete_permission", + "view_permission", + "add_token", + "change_token", + "delete_token", + "view_token", + "add_tokenproxy", + "change_tokenproxy", + "delete_tokenproxy", + "view_tokenproxy", + "add_contenttype", + "change_contenttype", + "delete_contenttype", + "view_contenttype", + "add_chordcounter", + "change_chordcounter", + "delete_chordcounter", + "view_chordcounter", + "add_groupresult", + "change_groupresult", + "delete_groupresult", + "view_groupresult", + "add_taskresult", + "change_taskresult", + "delete_taskresult", + "view_taskresult", + "add_failure", + "change_failure", + "delete_failure", + "view_failure", + "add_ormq", + "change_ormq", + "delete_ormq", + "view_ormq", + "add_schedule", + "change_schedule", + "delete_schedule", + "view_schedule", + "add_success", + "change_success", + "delete_success", + "view_success", + "add_task", + "change_task", + "delete_task", + "view_task", + "add_comment", + "change_comment", + "delete_comment", + "view_comment", + "add_correspondent", + "change_correspondent", + "delete_correspondent", + "view_correspondent", + "add_document", + "change_document", + "delete_document", + "view_document", + "add_documenttype", + "change_documenttype", + "delete_documenttype", + "view_documenttype", + "add_frontendsettings", + "change_frontendsettings", + "delete_frontendsettings", + "view_frontendsettings", + "add_log", + "change_log", + "delete_log", + "view_log", + "add_savedview", + "change_savedview", + "delete_savedview", + "view_savedview", + "add_savedviewfilterrule", + "change_savedviewfilterrule", + "delete_savedviewfilterrule", + "view_savedviewfilterrule", + "add_taskattributes", + "change_taskattributes", + "delete_taskattributes", + "view_taskattributes", + "add_session", + "change_session", + "delete_session", + "view_session" + ] + } + ] +} diff --git a/src-ui/cypress/fixtures/ui_settings/settings.json b/src-ui/cypress/fixtures/ui_settings/settings.json index 0e844b5e1..bc86255fc 100644 --- a/src-ui/cypress/fixtures/ui_settings/settings.json +++ b/src-ui/cypress/fixtures/ui_settings/settings.json @@ -1,7 +1,6 @@ { "user_id": 1, "username": "admin", - "display_name": "Admin", "settings": { "language": "", "bulk_edit": { @@ -30,5 +29,131 @@ "consumer_failed": true, "consumer_suppress_on_dashboard": true } - } + }, + "permissions": [ + "add_logentry", + "change_logentry", + "delete_logentry", + "view_logentry", + "add_group", + "change_group", + "delete_group", + "view_group", + "add_permission", + "change_permission", + "delete_permission", + "view_permission", + "add_user", + "change_user", + "delete_user", + "view_user", + "add_token", + "change_token", + "delete_token", + "view_token", + "add_tokenproxy", + "change_tokenproxy", + "delete_tokenproxy", + "view_tokenproxy", + "add_contenttype", + "change_contenttype", + "delete_contenttype", + "view_contenttype", + "add_chordcounter", + "change_chordcounter", + "delete_chordcounter", + "view_chordcounter", + "add_groupresult", + "change_groupresult", + "delete_groupresult", + "view_groupresult", + "add_taskresult", + "change_taskresult", + "delete_taskresult", + "view_taskresult", + "add_failure", + "change_failure", + "delete_failure", + "view_failure", + "add_ormq", + "change_ormq", + "delete_ormq", + "view_ormq", + "add_schedule", + "change_schedule", + "delete_schedule", + "view_schedule", + "add_success", + "change_success", + "delete_success", + "view_success", + "add_task", + "change_task", + "delete_task", + "view_task", + "add_comment", + "change_comment", + "delete_comment", + "view_comment", + "add_correspondent", + "change_correspondent", + "delete_correspondent", + "view_correspondent", + "add_document", + "change_document", + "delete_document", + "view_document", + "add_documenttype", + "change_documenttype", + "delete_documenttype", + "view_documenttype", + "add_frontendsettings", + "change_frontendsettings", + "delete_frontendsettings", + "view_frontendsettings", + "add_log", + "change_log", + "delete_log", + "view_log", + "add_paperlesstask", + "change_paperlesstask", + "delete_paperlesstask", + "view_paperlesstask", + "add_savedview", + "change_savedview", + "delete_savedview", + "view_savedview", + "add_savedviewfilterrule", + "change_savedviewfilterrule", + "delete_savedviewfilterrule", + "view_savedviewfilterrule", + "add_storagepath", + "change_storagepath", + "delete_storagepath", + "view_storagepath", + "add_tag", + "change_tag", + "delete_tag", + "view_tag", + "add_taskattributes", + "change_taskattributes", + "delete_taskattributes", + "view_taskattributes", + "add_uisettings", + "change_uisettings", + "delete_uisettings", + "view_uisettings", + "add_mailaccount", + "change_mailaccount", + "delete_mailaccount", + "view_mailaccount", + "add_mailrule", + "change_mailrule", + "delete_mailrule", + "view_mailrule", + "add_session", + "change_session", + "delete_session", + "view_session" + ] } diff --git a/src-ui/cypress/fixtures/ui_settings/settings_restricted.json b/src-ui/cypress/fixtures/ui_settings/settings_restricted.json new file mode 100644 index 000000000..4bc8a2d41 --- /dev/null +++ b/src-ui/cypress/fixtures/ui_settings/settings_restricted.json @@ -0,0 +1,84 @@ +{ + "user_id": 1, + "username": "admin", + "settings": { + "language": "", + "bulk_edit": { + "confirmation_dialogs": true, + "apply_on_close": false + }, + "documentListSize": 50, + "dark_mode": { + "use_system": true, + "enabled": "false", + "thumb_inverted": "true" + }, + "theme": { + "color": "#b198e5" + }, + "document_details": { + "native_pdf_viewer": false + }, + "date_display": { + "date_locale": "", + "date_format": "mediumDate" + }, + "notifications": { + "consumer_new_documents": true, + "consumer_success": true, + "consumer_failed": true, + "consumer_suppress_on_dashboard": true + } + }, + "permissions": [ + "add_token", + "change_token", + "delete_token", + "view_token", + "add_tokenproxy", + "change_tokenproxy", + "delete_tokenproxy", + "view_tokenproxy", + "add_contenttype", + "change_contenttype", + "delete_contenttype", + "view_contenttype", + "add_chordcounter", + "change_chordcounter", + "delete_chordcounter", + "view_chordcounter", + "add_groupresult", + "change_groupresult", + "delete_groupresult", + "view_groupresult", + "add_failure", + "change_failure", + "delete_failure", + "view_failure", + "add_ormq", + "change_ormq", + "delete_ormq", + "view_ormq", + "add_schedule", + "change_schedule", + "delete_schedule", + "view_schedule", + "add_success", + "change_success", + "delete_success", + "view_success", + "add_task", + "change_task", + "delete_task", + "view_task", + "add_comment", + "add_frontendsettings", + "change_frontendsettings", + "delete_frontendsettings", + "view_frontendsettings", + "add_session", + "change_session", + "delete_session", + "view_session" + ] +} diff --git a/src-ui/cypress/fixtures/users/users.json b/src-ui/cypress/fixtures/users/users.json new file mode 100644 index 000000000..ca477667a --- /dev/null +++ b/src-ui/cypress/fixtures/users/users.json @@ -0,0 +1,459 @@ +{ + "count": 4, + "next": null, + "previous": null, + "results": [ + { + "id": 3, + "username": "admin", + "password": "**********", + "first_name": "", + "last_name": "", + "date_joined": "2022-02-14T23:11:09.103293Z", + "is_staff": true, + "is_active": true, + "is_superuser": true, + "groups": [], + "user_permissions": [], + "inherited_permissions": [ + "auth.delete_permission", + "paperless_mail.change_mailrule", + "django_celery_results.add_taskresult", + "documents.view_taskattributes", + "documents.view_paperlesstask", + "django_q.add_success", + "documents.view_uisettings", + "auth.change_user", + "admin.delete_logentry", + "django_celery_results.change_taskresult", + "django_q.change_schedule", + "django_celery_results.delete_taskresult", + "paperless_mail.add_mailaccount", + "auth.change_group", + "documents.add_comment", + "paperless_mail.delete_mailaccount", + "authtoken.delete_tokenproxy", + "guardian.delete_groupobjectpermission", + "contenttypes.delete_contenttype", + "documents.change_correspondent", + "authtoken.delete_token", + "documents.delete_documenttype", + "django_q.change_ormq", + "documents.change_savedviewfilterrule", + "auth.delete_group", + "documents.add_documenttype", + "django_q.change_success", + "documents.delete_tag", + "documents.change_comment", + "django_q.delete_task", + "documents.add_savedviewfilterrule", + "django_q.view_task", + "paperless_mail.add_mailrule", + "paperless_mail.view_mailaccount", + "documents.add_frontendsettings", + "sessions.change_session", + "documents.view_savedview", + "authtoken.add_tokenproxy", + "documents.change_tag", + "documents.view_document", + "documents.add_savedview", + "auth.delete_user", + "documents.view_log", + "documents.view_comment", + "guardian.change_groupobjectpermission", + "sessions.delete_session", + "django_q.change_failure", + "guardian.change_userobjectpermission", + "documents.change_storagepath", + "documents.delete_document", + "documents.delete_taskattributes", + "django_celery_results.change_groupresult", + "django_q.add_ormq", + "guardian.view_groupobjectpermission", + "admin.change_logentry", + "django_q.delete_schedule", + "documents.delete_paperlesstask", + "django_q.view_ormq", + "documents.change_paperlesstask", + "guardian.delete_userobjectpermission", + "auth.view_permission", + "auth.view_user", + "django_q.add_schedule", + "authtoken.change_token", + "guardian.add_groupobjectpermission", + "documents.view_documenttype", + "documents.change_log", + "paperless_mail.delete_mailrule", + "auth.view_group", + "authtoken.view_token", + "admin.view_logentry", + "django_celery_results.view_chordcounter", + "django_celery_results.view_groupresult", + "documents.view_storagepath", + "documents.add_storagepath", + "django_celery_results.add_groupresult", + "documents.view_tag", + "guardian.view_userobjectpermission", + "documents.delete_correspondent", + "documents.add_tag", + "documents.delete_savedviewfilterrule", + "documents.add_correspondent", + "authtoken.view_tokenproxy", + "documents.delete_frontendsettings", + "django_celery_results.delete_chordcounter", + "django_q.change_task", + "documents.add_taskattributes", + "documents.delete_storagepath", + "sessions.add_session", + "documents.add_uisettings", + "documents.change_taskattributes", + "documents.delete_uisettings", + "django_q.delete_ormq", + "auth.change_permission", + "documents.view_savedviewfilterrule", + "documents.change_frontendsettings", + "documents.change_documenttype", + "documents.view_correspondent", + "auth.add_user", + "paperless_mail.change_mailaccount", + "documents.add_paperlesstask", + "django_q.view_success", + "django_celery_results.delete_groupresult", + "documents.delete_savedview", + "authtoken.change_tokenproxy", + "documents.view_frontendsettings", + "authtoken.add_token", + "django_celery_results.add_chordcounter", + "contenttypes.change_contenttype", + "admin.add_logentry", + "django_q.delete_failure", + "documents.change_uisettings", + "django_q.view_failure", + "documents.add_log", + "documents.change_savedview", + "paperless_mail.view_mailrule", + "django_q.view_schedule", + "documents.change_document", + "django_celery_results.change_chordcounter", + "documents.add_document", + "django_celery_results.view_taskresult", + "contenttypes.add_contenttype", + "django_q.delete_success", + "documents.delete_comment", + "django_q.add_failure", + "guardian.add_userobjectpermission", + "sessions.view_session", + "contenttypes.view_contenttype", + "auth.add_permission", + "documents.delete_log", + "django_q.add_task", + "auth.add_group" + ] + }, + { + "id": 15, + "username": "test", + "password": "**********", + "first_name": "", + "last_name": "", + "date_joined": "2022-11-23T08:30:54Z", + "is_staff": true, + "is_active": true, + "is_superuser": false, + "groups": [ + 1 + ], + "user_permissions": [ + "add_group", + "change_group", + "delete_group", + "view_group", + "add_permission", + "change_permission", + "delete_permission", + "view_permission", + "add_token", + "change_token", + "delete_token", + "view_token", + "add_tokenproxy", + "change_tokenproxy", + "delete_tokenproxy", + "view_tokenproxy", + "add_contenttype", + "change_contenttype", + "delete_contenttype", + "view_contenttype", + "add_chordcounter", + "change_chordcounter", + "delete_chordcounter", + "view_chordcounter", + "add_groupresult", + "change_groupresult", + "delete_groupresult", + "view_groupresult", + "add_taskresult", + "change_taskresult", + "delete_taskresult", + "view_taskresult", + "add_failure", + "change_failure", + "delete_failure", + "view_failure", + "add_ormq", + "change_ormq", + "delete_ormq", + "view_ormq", + "add_schedule", + "change_schedule", + "delete_schedule", + "view_schedule", + "add_success", + "change_success", + "delete_success", + "view_success", + "add_task", + "change_task", + "delete_task", + "view_task", + "add_comment", + "change_comment", + "delete_comment", + "view_comment", + "add_frontendsettings", + "change_frontendsettings", + "delete_frontendsettings", + "view_frontendsettings", + "add_log", + "change_log", + "delete_log", + "view_log", + "add_savedviewfilterrule", + "change_savedviewfilterrule", + "delete_savedviewfilterrule", + "view_savedviewfilterrule", + "add_taskattributes", + "change_taskattributes", + "delete_taskattributes", + "view_taskattributes", + "add_session", + "change_session", + "delete_session", + "view_session" + ], + "inherited_permissions": [ + "auth.delete_permission", + "django_celery_results.add_taskresult", + "documents.view_taskattributes", + "django_q.add_ormq", + "django_q.add_success", + "django_q.delete_schedule", + "django_q.view_ormq", + "auth.view_permission", + "django_q.add_schedule", + "django_celery_results.change_taskresult", + "django_q.change_schedule", + "django_celery_results.delete_taskresult", + "authtoken.change_token", + "auth.change_group", + "documents.add_comment", + "authtoken.delete_tokenproxy", + "documents.view_documenttype", + "contenttypes.delete_contenttype", + "documents.change_correspondent", + "authtoken.delete_token", + "documents.change_log", + "auth.view_group", + "authtoken.view_token", + "django_celery_results.view_chordcounter", + "django_celery_results.view_groupresult", + "documents.delete_documenttype", + "django_q.change_ormq", + "documents.change_savedviewfilterrule", + "django_celery_results.add_groupresult", + "auth.delete_group", + "documents.add_documenttype", + "django_q.change_success", + "auth.add_permission", + "documents.delete_correspondent", + "documents.delete_savedviewfilterrule", + "documents.add_correspondent", + "authtoken.view_tokenproxy", + "documents.delete_frontendsettings", + "django_celery_results.delete_chordcounter", + "documents.add_taskattributes", + "django_q.change_task", + "sessions.add_session", + "documents.change_taskattributes", + "documents.change_comment", + "django_q.delete_task", + "django_q.delete_ormq", + "auth.change_permission", + "documents.add_savedviewfilterrule", + "django_q.view_task", + "documents.view_savedviewfilterrule", + "documents.change_frontendsettings", + "documents.change_documenttype", + "documents.view_correspondent", + "django_q.view_success", + "documents.add_frontendsettings", + "django_celery_results.delete_groupresult", + "documents.delete_savedview", + "authtoken.change_tokenproxy", + "documents.view_frontendsettings", + "authtoken.add_token", + "sessions.change_session", + "django_celery_results.add_chordcounter", + "documents.view_savedview", + "contenttypes.change_contenttype", + "django_q.delete_failure", + "authtoken.add_tokenproxy", + "documents.view_document", + "documents.add_savedview", + "django_q.view_failure", + "documents.view_comment", + "documents.view_log", + "documents.add_log", + "documents.change_savedview", + "django_q.view_schedule", + "documents.change_document", + "django_celery_results.change_chordcounter", + "documents.add_document", + "sessions.delete_session", + "django_q.change_failure", + "django_celery_results.view_taskresult", + "contenttypes.add_contenttype", + "django_q.delete_success", + "documents.delete_comment", + "django_q.add_failure", + "sessions.view_session", + "contenttypes.view_contenttype", + "documents.delete_taskattributes", + "documents.delete_document", + "documents.delete_log", + "django_q.add_task", + "django_celery_results.change_groupresult", + "auth.add_group" + ] + }, + { + "id": 6, + "username": "testuser", + "password": "**********", + "first_name": "", + "last_name": "", + "date_joined": "2022-11-16T04:14:20.484914Z", + "is_staff": false, + "is_active": true, + "is_superuser": false, + "groups": [ + 1, + 6 + ], + "user_permissions": [ + "add_logentry", + "change_logentry", + "delete_logentry", + "view_logentry" + ], + "inherited_permissions": [ + "auth.delete_permission", + "django_celery_results.add_taskresult", + "documents.view_taskattributes", + "django_q.add_ormq", + "django_q.add_success", + "django_q.delete_schedule", + "django_q.view_ormq", + "auth.change_user", + "auth.view_permission", + "auth.view_user", + "django_q.add_schedule", + "django_celery_results.change_taskresult", + "django_q.change_schedule", + "django_celery_results.delete_taskresult", + "authtoken.change_token", + "auth.change_group", + "documents.add_comment", + "authtoken.delete_tokenproxy", + "documents.view_documenttype", + "contenttypes.delete_contenttype", + "documents.change_correspondent", + "authtoken.delete_token", + "documents.change_log", + "auth.view_group", + "authtoken.view_token", + "django_celery_results.view_chordcounter", + "django_celery_results.view_groupresult", + "documents.delete_documenttype", + "django_q.change_ormq", + "documents.change_savedviewfilterrule", + "django_celery_results.add_groupresult", + "auth.delete_group", + "documents.add_documenttype", + "django_q.change_success", + "auth.add_permission", + "documents.delete_correspondent", + "documents.delete_savedviewfilterrule", + "documents.add_correspondent", + "authtoken.view_tokenproxy", + "documents.delete_frontendsettings", + "django_celery_results.delete_chordcounter", + "documents.add_taskattributes", + "django_q.change_task", + "sessions.add_session", + "documents.change_taskattributes", + "documents.change_comment", + "django_q.delete_task", + "django_q.delete_ormq", + "auth.change_permission", + "documents.add_savedviewfilterrule", + "django_q.view_task", + "documents.view_savedviewfilterrule", + "documents.change_frontendsettings", + "documents.change_documenttype", + "documents.view_correspondent", + "auth.add_user", + "django_q.view_success", + "documents.add_frontendsettings", + "django_celery_results.delete_groupresult", + "documents.delete_savedview", + "authtoken.change_tokenproxy", + "documents.view_frontendsettings", + "authtoken.add_token", + "sessions.change_session", + "django_celery_results.add_chordcounter", + "documents.view_savedview", + "contenttypes.change_contenttype", + "django_q.delete_failure", + "authtoken.add_tokenproxy", + "documents.view_document", + "documents.add_savedview", + "django_q.view_failure", + "documents.view_comment", + "documents.view_log", + "auth.delete_user", + "documents.add_log", + "documents.change_savedview", + "django_q.view_schedule", + "documents.change_document", + "django_celery_results.change_chordcounter", + "documents.add_document", + "sessions.delete_session", + "django_q.change_failure", + "django_celery_results.view_taskresult", + "contenttypes.add_contenttype", + "django_q.delete_success", + "documents.delete_comment", + "django_q.add_failure", + "sessions.view_session", + "contenttypes.view_contenttype", + "documents.delete_taskattributes", + "documents.delete_document", + "documents.delete_log", + "django_q.add_task", + "django_celery_results.change_groupresult", + "auth.add_group" + ] + } + ] +} diff --git a/src-ui/cypress/support/e2e.ts b/src-ui/cypress/support/e2e.ts index 1d17409c2..1a8ef1710 100644 --- a/src-ui/cypress/support/e2e.ts +++ b/src-ui/cypress/support/e2e.ts @@ -5,6 +5,14 @@ beforeEach(() => { fixture: 'ui_settings/settings.json', }).as('ui-settings') + cy.intercept('http://localhost:8000/api/users/*', { + fixture: 'users/users.json', + }) + + cy.intercept('http://localhost:8000/api/groups/*', { + fixture: 'groups/groups.json', + }) + cy.intercept('http://localhost:8000/api/remote_version/', { fixture: 'remote_version/remote_version.json', }) diff --git a/src-ui/messages.xlf b/src-ui/messages.xlf index 5f687a0bd..16f00a722 100644 --- a/src-ui/messages.xlf +++ b/src-ui/messages.xlf @@ -254,60 +254,68 @@ Document added src/app/app.component.ts - 78 + 90 + + + src/app/app.component.ts + 100 Document was added to paperless. src/app/app.component.ts - 80 + 92 + + + src/app/app.component.ts + 102 Open document src/app/app.component.ts - 81 + 93 src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.html - 45 + 46 Could not add : src/app/app.component.ts - 97 + 116 New document detected src/app/app.component.ts - 112 + 131 Document is being processed by paperless. src/app/app.component.ts - 114 + 133 Prev src/app/app.component.ts - 119 + 138 Next src/app/app.component.ts - 120 + 139 src/app/components/document-detail/document-detail.component.html @@ -318,91 +326,91 @@ End src/app/app.component.ts - 121 + 140 The dashboard can be used to show saved views, such as an 'Inbox'. Those settings are found under Settings > Saved Views once you have created some. src/app/app.component.ts - 126 + 145 Drag-and-drop documents here to start uploading or place them in the consume folder. You can also drag-and-drop documents anywhere on all other pages of the web app. Once you do, Paperless-ngx will start training its machine learning algorithms. src/app/app.component.ts - 136 + 155 The documents list shows all of your documents and allows for filtering as well as bulk-editing. There are three different view styles: list, small cards and large cards. A list of documents currently opened for editing is shown in the sidebar. src/app/app.component.ts - 145 + 164 The filtering tools allow you to quickly find documents using various searches, dates, tags, etc. src/app/app.component.ts - 157 + 176 Any combination of filters can be saved as a 'view' which can then be displayed on the dashboard and / or sidebar. src/app/app.component.ts - 167 + 186 Tags, correspondents, document types and storage paths can all be managed using these pages. They can also be created from the document edit view. src/app/app.component.ts - 176 + 195 File Tasks shows you documents that have been consumed, are waiting to be, or may have failed during the process. src/app/app.component.ts - 185 + 204 Check out the settings for various tweaks to the web app, toggle settings for saved views or setup e-mail checking. src/app/app.component.ts - 194 + 213 Thank you! 🙏 src/app/app.component.ts - 203 + 222 There are <em>tons</em> more features and info we didn't cover here, but this should get you started. Check out the documentation or visit the project on GitHub to learn more or to report issues. src/app/app.component.ts - 205 + 224 Lastly, on behalf of every contributor to this community-supported project, thank you for using Paperless-ngx! src/app/app.component.ts - 207 + 226 Initiating upload... src/app/app.component.ts - 256 + 281 @@ -435,16 +443,20 @@ src/app/components/app-frame/app-frame.component.html - 171 + 174 src/app/components/app-frame/app-frame.component.html - 174 + 177 src/app/components/manage/settings/settings.component.html 1 + + src/app/components/manage/settings/settings.component.html + 192 + Logout @@ -480,7 +492,7 @@ src/app/components/document-list/document-list.component.ts - 88 + 94 src/app/components/manage/management-list/management-list.component.html @@ -514,47 +526,47 @@ Open documents src/app/components/app-frame/app-frame.component.html - 99 + 101 Close all src/app/components/app-frame/app-frame.component.html - 115 + 117 src/app/components/app-frame/app-frame.component.html - 118 + 120 Manage src/app/components/app-frame/app-frame.component.html - 124 + 127 Correspondents src/app/components/app-frame/app-frame.component.html - 128 + 131 src/app/components/app-frame/app-frame.component.html - 131 + 134 Tags src/app/components/app-frame/app-frame.component.html - 135 + 138 src/app/components/app-frame/app-frame.component.html - 138 + 141 src/app/components/common/input/tags/tags.component.html @@ -573,29 +585,29 @@ Document types src/app/components/app-frame/app-frame.component.html - 142 + 145 src/app/components/app-frame/app-frame.component.html - 145 + 148 Storage paths src/app/components/app-frame/app-frame.component.html - 149 + 152 src/app/components/app-frame/app-frame.component.html - 152 + 155 File Tasks src/app/components/app-frame/app-frame.component.html - 156 + 159 src/app/components/manage/tasks/tasks.component.html @@ -606,18 +618,18 @@ File Tasks src/app/components/app-frame/app-frame.component.html - 160 + 163 Logs src/app/components/app-frame/app-frame.component.html - 164 + 167 src/app/components/app-frame/app-frame.component.html - 167 + 170 src/app/components/manage/logs/logs.component.html @@ -628,7 +640,7 @@ Info src/app/components/app-frame/app-frame.component.html - 180 + 183 src/app/components/manage/tasks/tasks.component.html @@ -639,86 +651,86 @@ Documentation src/app/components/app-frame/app-frame.component.html - 184 + 187 src/app/components/app-frame/app-frame.component.html - 187 + 190 GitHub src/app/components/app-frame/app-frame.component.html - 192 + 195 src/app/components/app-frame/app-frame.component.html - 195 + 198 Suggest an idea src/app/components/app-frame/app-frame.component.html - 197 + 200 src/app/components/app-frame/app-frame.component.html - 201 + 204 is available. src/app/components/app-frame/app-frame.component.html - 210 + 213 Click to view. src/app/components/app-frame/app-frame.component.html - 210 + 213 Paperless-ngx can automatically check for updates src/app/components/app-frame/app-frame.component.html - 214 + 217 How does this work? src/app/components/app-frame/app-frame.component.html - 221,223 + 224,226 Update available src/app/components/app-frame/app-frame.component.html - 232 + 235 An error occurred while saving settings. src/app/components/app-frame/app-frame.component.ts - 83 + 89 src/app/components/manage/settings/settings.component.ts - 492 + 574 An error occurred while saving update checking settings. src/app/components/app-frame/app-frame.component.ts - 216 + 222 @@ -757,20 +769,24 @@ 32 - src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 279 + src/app/components/common/permissions-dialog/permissions-dialog.component.html + 17 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 319 + 307 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 357 + 347 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 395 + 385 + + + src/app/components/document-list/bulk-editor/bulk-editor.component.ts + 423 @@ -819,11 +835,15 @@ Name src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html - 8 + 9 src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html - 9 + 10 + + + src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.html + 10 src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.html @@ -835,7 +855,7 @@ src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.html - 13 + 9 src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.html @@ -879,15 +899,23 @@ src/app/components/manage/settings/settings.component.html - 196 + 204 src/app/components/manage/settings/settings.component.html - 248 + 257 src/app/components/manage/settings/settings.component.html - 283 + 294 + + + src/app/components/manage/settings/settings.component.html + 345 + + + src/app/components/manage/settings/settings.component.html + 379 src/app/components/manage/tasks/tasks.component.html @@ -898,15 +926,15 @@ Matching algorithm src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html - 9 - - - src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html 10 + + src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html + 11 + src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.html - 15 + 11 src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.html @@ -917,15 +945,15 @@ Matching pattern src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html - 10 - - - src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html 11 + + src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html + 12 + src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.html - 16 + 12 src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.html @@ -936,15 +964,15 @@ Case insensitive src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html - 11 - - - src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html 12 + + src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html + 13 + src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.html - 17 + 13 src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.html @@ -955,10 +983,14 @@ Cancel src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html - 14 + 20 src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html + 22 + + + src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.html 16 @@ -975,7 +1007,15 @@ src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.html - 18 + 23 + + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 35 + + + src/app/components/common/permissions-dialog/permissions-dialog.component.html + 16 src/app/components/common/select-dialog/select-dialog.component.html @@ -994,10 +1034,14 @@ Save src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html - 15 + 21 src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.html + 23 + + + src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.html 17 @@ -1014,11 +1058,15 @@ src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.html - 19 + 24 + + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 36 src/app/components/document-detail/document-detail.component.html - 185 + 196 src/app/components/document-list/save-view-config-dialog/save-view-config-dialog.component.html @@ -1026,56 +1074,93 @@ src/app/components/manage/settings/settings.component.html - 317 + 415 Create new correspondent src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.ts - 20 + 25 Edit correspondent src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.ts - 24 + 29 Create new document type src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.ts - 20 + 25 Edit document type src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.ts - 24 + 29 Create new item src/app/components/common/edit-dialog/edit-dialog.component.ts - 49 + 67 Edit item src/app/components/common/edit-dialog/edit-dialog.component.ts - 53 + 71 Could not save element: src/app/components/common/edit-dialog/edit-dialog.component.ts - 57 + 75 + + + + Permissions + + src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.html + 11 + + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 30 + + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 2 + + + src/app/components/document-detail/document-detail.component.html + 182 + + + src/app/components/document-list/bulk-editor/bulk-editor.component.html + 77 + + + + Create new user group + + src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.ts + 24 + + + + Edit user group + + src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.ts + 28 @@ -1105,6 +1190,14 @@ src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.html 16 + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 10 + + + src/app/components/manage/settings/settings.component.html + 344 + Password @@ -1112,6 +1205,10 @@ src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.html 17 + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 12 + Character Set @@ -1124,35 +1221,35 @@ No encryption src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts - 12 + 13 SSL src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts - 13 + 14 STARTTLS src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts - 14 + 15 Create new mail account src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts - 28 + 33 Edit mail account src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts - 32 + 37 @@ -1163,7 +1260,7 @@ src/app/components/manage/settings/settings.component.html - 284 + 295 @@ -1314,46 +1411,50 @@ src/app/services/toast.service.ts - 32 + 35 Only process attachments src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 25 + 26 src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 36 + 37 Process all files, including 'inline' attachments src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 29 + 30 Process message as .eml src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 40 + 41 Process message as .eml and attachments separately src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 44 + 45 Delete src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 51 + 52 + + + src/app/components/common/permissions-select/permissions-select.component.html + 9 src/app/components/document-detail/document-detail.component.html @@ -1361,7 +1462,7 @@ src/app/components/document-list/bulk-editor/bulk-editor.component.html - 126 + 137 src/app/components/manage/management-list/management-list.component.html @@ -1397,156 +1498,157 @@ src/app/components/manage/management-list/management-list.component.ts - 181 + 192 src/app/components/manage/settings/settings.component.html - 214 + 222 src/app/components/manage/settings/settings.component.html - 261 + 270 src/app/components/manage/settings/settings.component.html - 296 + 307 + + + src/app/components/manage/settings/settings.component.html + 359 + + + src/app/components/manage/settings/settings.component.html + 394 Move to specified folder src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 55 + 56 Mark as read, don't process read mails src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 59 + 60 Flag the mail, don't process flagged mails src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 63 + 64 Tag the mail with specified tag, don't process tagged mails src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 67 + 68 Use subject as title src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 74 + 75 Use attachment filename as title src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 78 + 79 Do not assign a correspondent src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 85 + 86 Use mail address src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 89 + 90 Use name (or mail address if not available) src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 93 + 94 Use correspondent selected below src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 97 + 98 Create new mail rule src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 137 + 139 Edit mail rule src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts - 141 - - - - Note that editing a path does not apply changes to stored files until you have run the 'document_renamer' utility. See the documentation. - - src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.html - 10 + 143 Path src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.html - 14 + 10 src/app/components/manage/storage-path-list/storage-path-list.component.ts - 35 + 42 e.g. src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts - 21 + 26 or use slashes to add directories e.g. src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts - 23 + 28 See <a target="_blank" href="https://docs.paperless-ngx.com/advanced_usage/#file-name-handling">documentation</a> for full list. src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts - 25 + 30 Create new storage path src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts - 30 + 35 Edit storage path src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts - 34 + 39 @@ -1557,7 +1659,7 @@ src/app/components/manage/tag-list/tag-list.component.ts - 35 + 42 @@ -1578,14 +1680,85 @@ Create new tag src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.ts - 21 + 26 Edit tag src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.ts - 25 + 30 + + + + Email + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 11 + + + + First name + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 13 + + + + Last name + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 14 + + + + Active + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 19 + + + + Superuser + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 23 + + + + (Grants all permissions and can view objects) + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 23 + + + + Groups + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html + 27 + + + src/app/components/manage/settings/settings.component.html + 346 + + + src/app/components/manage/settings/settings.component.html + 367 + + + + Create new user account + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.ts + 41 + + + + Edit user account + + src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.ts + 45 @@ -1594,6 +1767,14 @@ src/app/components/common/filterable-dropdown/filterable-dropdown.component.html 16 + + src/app/components/common/permissions-select/permissions-select.component.html + 6 + + + src/app/components/common/permissions-select/permissions-select.component.html + 17 + src/app/components/document-list/bulk-editor/bulk-editor.component.html 20 @@ -1643,11 +1824,139 @@ src/app/components/common/input/select/select.component.html - 30 + 31 src/app/components/common/input/tags/tags.component.html - 42 + 43 + + + + Edit Permissions + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 7 + + + + Owner: + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 19 + + + + Objects without an owner can be viewed and edited by all users + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 25 + + + + View + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 27 + + + src/app/components/common/permissions-select/permissions-select.component.html + 10 + + + src/app/components/document-list/document-card-large/document-card-large.component.html + 56 + + + + Users: + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 31 + + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 50 + + + + Groups: + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 39 + + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 58 + + + + Edit + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 46 + + + src/app/components/document-list/document-card-large/document-card-large.component.html + 49 + + + src/app/components/document-list/document-card-small/document-card-small.component.html + 70 + + + src/app/components/manage/management-list/management-list.component.html + 45 + + + src/app/components/manage/management-list/management-list.component.html + 45 + + + src/app/components/manage/management-list/management-list.component.html + 45 + + + src/app/components/manage/management-list/management-list.component.html + 45 + + + src/app/components/manage/management-list/management-list.component.html + 59 + + + src/app/components/manage/management-list/management-list.component.html + 59 + + + src/app/components/manage/management-list/management-list.component.html + 59 + + + src/app/components/manage/management-list/management-list.component.html + 59 + + + src/app/components/manage/settings/settings.component.html + 269 + + + src/app/components/manage/settings/settings.component.html + 306 + + + src/app/components/manage/settings/settings.component.html + 358 + + + src/app/components/manage/settings/settings.component.html + 393 + + + + Edit permissions also grant viewing permissions + + src/app/components/common/input/permissions/permissions-form/permissions-form.component.html + 64 @@ -1662,9 +1971,62 @@ Add tag src/app/components/common/input/tags/tags.component.html + 12 + + + + Set Permissions + + src/app/components/common/permissions-dialog/permissions-dialog.component.ts + 26 + + + + Note that permissions set here will override any existing permissions + + src/app/components/common/permissions-dialog/permissions-dialog.component.ts + 41 + + + + Type + + src/app/components/common/permissions-select/permissions-select.component.html + 5 + + + + Add + + src/app/components/common/permissions-select/permissions-select.component.html + 7 + + + + Change + + src/app/components/common/permissions-select/permissions-select.component.html + 8 + + + + + + src/app/components/common/permissions-select/permissions-select.component.html + 22 + + + src/app/components/manage/tasks/tasks.component.html 11 + + Inerhited from group + + src/app/components/common/permissions-select/permissions-select.component.ts + 59 + + Select @@ -1699,15 +2061,19 @@ src/app/components/document-list/document-list.component.html - 93 + 95 src/app/components/manage/settings/settings.component.html - 222 + 230 src/app/components/manage/settings/settings.component.html - 308 + 320 + + + src/app/components/manage/settings/settings.component.html + 406 src/app/components/manage/tasks/tasks.component.html @@ -1722,14 +2088,14 @@ Hello , welcome to Paperless-ngx src/app/components/dashboard/dashboard.component.ts - 18 + 21 Welcome to Paperless-ngx src/app/components/dashboard/dashboard.component.ts - 20 + 23 @@ -1751,7 +2117,7 @@ src/app/components/document-list/document-list.component.html - 157 + 159 src/app/components/document-list/filter-editor/filter-editor.component.html @@ -1778,7 +2144,7 @@ src/app/components/document-list/document-list.component.html - 139 + 141 src/app/components/document-list/filter-editor/filter-editor.component.ts @@ -1851,32 +2217,32 @@ Processing: src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts - 36 + 39 Failed: src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts - 39 + 42 Added: src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts - 42 + 45 , src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts - 45 + 48 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 224 + 252 this string is used to separate processing, failed and added on the file upload widget @@ -1947,14 +2313,14 @@ Error saving comment: src/app/components/document-comments/document-comments.component.ts - 68 + 71 Error deleting comment: src/app/components/document-comments/document-comments.component.ts - 83 + 86 @@ -1983,7 +2349,7 @@ src/app/components/document-list/bulk-editor/bulk-editor.component.html - 90 + 101 src/app/components/document-list/document-card-large/document-card-large.component.html @@ -2009,7 +2375,7 @@ src/app/components/document-list/bulk-editor/bulk-editor.component.html - 77 + 88 @@ -2031,7 +2397,7 @@ src/app/guards/dirty-saved-view.guard.ts - 32 + 40 @@ -2070,11 +2436,11 @@ src/app/components/document-list/bulk-editor/bulk-editor.component.html - 38 + 39 src/app/components/document-list/document-list.component.html - 133 + 135 src/app/components/document-list/filter-editor/filter-editor.component.html @@ -2093,11 +2459,11 @@ src/app/components/document-list/bulk-editor/bulk-editor.component.html - 47 + 49 src/app/components/document-list/document-list.component.html - 145 + 147 src/app/components/document-list/filter-editor/filter-editor.component.html @@ -2116,11 +2482,11 @@ src/app/components/document-list/bulk-editor/bulk-editor.component.html - 56 + 59 src/app/components/document-list/document-list.component.html - 151 + 153 src/app/components/document-list/filter-editor/filter-editor.component.html @@ -2229,6 +2595,13 @@ 145 + + Preview + + src/app/components/document-detail/document-detail.component.html + 151 + + Enter Password @@ -2237,14 +2610,14 @@ src/app/components/document-detail/document-detail.component.html - 203 + 215 Comments src/app/components/document-detail/document-detail.component.html - 174 + 175 src/app/components/manage/settings/settings.component.html @@ -2255,120 +2628,161 @@ Discard src/app/components/document-detail/document-detail.component.html - 183 + 194 Save & next src/app/components/document-detail/document-detail.component.html - 184 + 195 + + + + Error retrieving metadata + + src/app/components/document-detail/document-detail.component.ts + 305 + + + + Error retrieving suggestions + + src/app/components/document-detail/document-detail.component.ts + 319 + + + + Error saving document + + src/app/components/document-detail/document-detail.component.ts + 432 + + + src/app/components/document-detail/document-detail.component.ts + 476 Confirm delete src/app/components/document-detail/document-detail.component.ts - 453 + 505 src/app/components/manage/management-list/management-list.component.ts - 177 + 188 Do you really want to delete document ""? src/app/components/document-detail/document-detail.component.ts - 454 + 506 The files for this document will be deleted permanently. This operation cannot be undone. src/app/components/document-detail/document-detail.component.ts - 455 + 507 Delete document src/app/components/document-detail/document-detail.component.ts - 457 + 509 Error deleting document: src/app/components/document-detail/document-detail.component.ts - 473 + 525 Redo OCR confirm src/app/components/document-detail/document-detail.component.ts - 493 + 545 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 454 + 482 This operation will permanently redo OCR for this document. src/app/components/document-detail/document-detail.component.ts - 494 + 546 This operation cannot be undone. src/app/components/document-detail/document-detail.component.ts - 495 + 547 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 417 + 445 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 456 + 484 src/app/components/manage/settings/settings.component.ts - 576 + 657 src/app/components/manage/settings/settings.component.ts - 635 + 711 + + + src/app/components/manage/settings/settings.component.ts + 772 + + + src/app/components/manage/settings/settings.component.ts + 831 Proceed src/app/components/document-detail/document-detail.component.ts - 497 + 549 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 458 + 486 src/app/components/manage/settings/settings.component.ts - 578 + 659 src/app/components/manage/settings/settings.component.ts - 637 + 713 + + + src/app/components/manage/settings/settings.component.ts + 774 + + + src/app/components/manage/settings/settings.component.ts + 833 Redo OCR operation will begin in the background. Close and re-open or reload this document after the operation has completed to see new content. src/app/components/document-detail/document-detail.component.ts - 505 + 557 @@ -2377,7 +2791,7 @@ )"/> src/app/components/document-detail/document-detail.component.ts - 516,518 + 568,570 @@ -2409,7 +2823,7 @@ Filter correspondents src/app/components/document-list/bulk-editor/bulk-editor.component.html - 39 + 40 src/app/components/document-list/filter-editor/filter-editor.component.html @@ -2420,7 +2834,7 @@ Filter document types src/app/components/document-list/bulk-editor/bulk-editor.component.html - 48 + 50 src/app/components/document-list/filter-editor/filter-editor.component.html @@ -2431,7 +2845,7 @@ Filter storage paths src/app/components/document-list/bulk-editor/bulk-editor.component.html - 57 + 60 src/app/components/document-list/filter-editor/filter-editor.component.html @@ -2442,7 +2856,7 @@ Actions src/app/components/document-list/bulk-editor/bulk-editor.component.html - 74 + 85 src/app/components/manage/management-list/management-list.component.html @@ -2462,15 +2876,23 @@ src/app/components/manage/settings/settings.component.html - 213 + 221 src/app/components/manage/settings/settings.component.html - 250 + 259 src/app/components/manage/settings/settings.component.html - 285 + 296 + + + src/app/components/manage/settings/settings.component.html + 347 + + + src/app/components/manage/settings/settings.component.html + 382 src/app/components/manage/tasks/tasks.component.html @@ -2481,28 +2903,28 @@ Include: src/app/components/document-list/bulk-editor/bulk-editor.component.html - 96 + 107 Archived files src/app/components/document-list/bulk-editor/bulk-editor.component.html - 100,102 + 111,113 Original files src/app/components/document-list/bulk-editor/bulk-editor.component.html - 106,108 + 117,119 Use formatted filename src/app/components/document-list/bulk-editor/bulk-editor.component.html - 113,115 + 124,126 @@ -2511,25 +2933,25 @@ )"/> src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 144,146 + 172,174 "" src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 216 + 244 src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 222 + 250 "" and "" src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 218 + 246 This is for messages like 'modify "tag1" and "tag2"' @@ -2537,7 +2959,7 @@ and "" src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 226,228 + 254,256 this is for messages like 'modify "tag1", "tag2" and "tag3"' @@ -2545,14 +2967,14 @@ Confirm tags assignment src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 243 + 271 This operation will add the tag "" to selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 249 + 277 @@ -2561,14 +2983,14 @@ )"/> to selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 254,256 + 282,284 This operation will remove the tag "" from selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 262 + 290 @@ -2577,7 +2999,7 @@ )"/> from selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 267,269 + 295,297 @@ -2588,98 +3010,98 @@ )"/> on selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 271,275 + 299,303 Confirm correspondent assignment src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 312 + 340 This operation will assign the correspondent "" to selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 314 + 342 This operation will remove the correspondent from selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 316 + 344 Confirm document type assignment src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 350 + 378 This operation will assign the document type "" to selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 352 + 380 This operation will remove the document type from selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 354 + 382 Confirm storage path assignment src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 388 + 416 This operation will assign the storage path "" to selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 390 + 418 This operation will remove the storage path from selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 392 + 420 Delete confirm src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 415 + 443 This operation will permanently delete selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 416 + 444 Delete document(s) src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 419 + 447 This operation will permanently redo OCR for selected document(s). src/app/components/document-list/bulk-editor/bulk-editor.component.ts - 455 + 483 @@ -2690,7 +3112,7 @@ src/app/components/document-list/document-list.component.html - 178 + 180 @@ -2701,65 +3123,7 @@ src/app/components/document-list/document-list.component.html - 183 - - - - Edit - - src/app/components/document-list/document-card-large/document-card-large.component.html - 49 - - - src/app/components/document-list/document-card-small/document-card-small.component.html - 70 - - - src/app/components/manage/management-list/management-list.component.html - 45 - - - src/app/components/manage/management-list/management-list.component.html - 45 - - - src/app/components/manage/management-list/management-list.component.html - 45 - - - src/app/components/manage/management-list/management-list.component.html - 45 - - - src/app/components/manage/management-list/management-list.component.html - 59 - - - src/app/components/manage/management-list/management-list.component.html - 59 - - - src/app/components/manage/management-list/management-list.component.html - 59 - - - src/app/components/manage/management-list/management-list.component.html - 59 - - - src/app/components/manage/settings/settings.component.html - 260 - - - src/app/components/manage/settings/settings.component.html - 295 - - - - View - - src/app/components/document-list/document-card-large/document-card-large.component.html - 56 + 185 @@ -2770,7 +3134,7 @@ src/app/components/document-list/document-list.component.html - 187 + 189 @@ -2781,7 +3145,7 @@ src/app/components/document-list/document-list.component.html - 192 + 194 @@ -2886,54 +3250,58 @@ src/app/components/document-list/document-list.component.html 64 + + src/app/components/manage/settings/settings.component.html + 199 + Save "" src/app/components/document-list/document-list.component.html - 75 + 76 Save as... src/app/components/document-list/document-list.component.html - 76 + 78 {VAR_PLURAL, plural, =1 {Selected of one document} other {Selected of documents}} src/app/components/document-list/document-list.component.html - 95 + 97 {VAR_PLURAL, plural, =1 {One document} other { documents}} src/app/components/document-list/document-list.component.html - 97 + 99 (filtered) src/app/components/document-list/document-list.component.html - 97 + 99 Error while loading documents src/app/components/document-list/document-list.component.html - 110 + 112 ASN src/app/components/document-list/document-list.component.html - 128,127 + 130,129 src/app/components/document-list/filter-editor/filter-editor.component.ts @@ -2948,7 +3316,7 @@ Added src/app/components/document-list/document-list.component.html - 163 + 165 src/app/components/document-list/filter-editor/filter-editor.component.html @@ -2963,21 +3331,21 @@ Edit document src/app/components/document-list/document-list.component.html - 182 + 184 View "" saved successfully. src/app/components/document-list/document-list.component.ts - 196 + 202 View "" created successfully. src/app/components/document-list/document-list.component.ts - 237 + 243 @@ -3114,7 +3482,7 @@ src/app/components/manage/settings/settings.component.html - 208 + 216 @@ -3125,7 +3493,7 @@ src/app/components/manage/settings/settings.component.html - 204 + 212 @@ -3146,49 +3514,49 @@ correspondent src/app/components/manage/correspondent-list/correspondent-list.component.ts - 33 + 39 correspondents src/app/components/manage/correspondent-list/correspondent-list.component.ts - 34 + 40 Last used src/app/components/manage/correspondent-list/correspondent-list.component.ts - 38 + 45 Do you really want to delete the correspondent ""? src/app/components/manage/correspondent-list/correspondent-list.component.ts - 48 + 55 document type src/app/components/manage/document-type-list/document-type-list.component.ts - 30 + 36 document types src/app/components/manage/document-type-list/document-type-list.component.ts - 31 + 37 Do you really want to delete the document type ""? src/app/components/manage/document-type-list/document-type-list.component.ts - 37 + 44 @@ -3309,7 +3677,7 @@ Automatic src/app/components/manage/management-list/management-list.component.ts - 87 + 98 src/app/data/matching-model.ts @@ -3320,42 +3688,42 @@ Successfully created . src/app/components/manage/management-list/management-list.component.ts - 127 + 138 Error occurred while creating : . src/app/components/manage/management-list/management-list.component.ts - 132,134 + 143,145 Successfully updated . src/app/components/manage/management-list/management-list.component.ts - 150 + 161 Error occurred while saving : . src/app/components/manage/management-list/management-list.component.ts - 155,157 + 166,168 Do you really want to delete the ? src/app/components/manage/management-list/management-list.component.ts - 164 + 175 Associated documents will not be deleted. src/app/components/manage/management-list/management-list.component.ts - 179 + 190 @@ -3364,7 +3732,7 @@ )"/> src/app/components/manage/management-list/management-list.component.ts - 192,194 + 203,205 @@ -3647,123 +4015,158 @@ 181 + + Show warning when closing saved views with unsaved changes + + src/app/components/manage/settings/settings.component.html + 195 + + Appears on src/app/components/manage/settings/settings.component.html - 201 + 209 No saved views defined. src/app/components/manage/settings/settings.component.html - 218 + 226 Mail src/app/components/manage/settings/settings.component.html - 232,231 + 240,239 Mail accounts src/app/components/manage/settings/settings.component.html - 236 + 245 Add Account src/app/components/manage/settings/settings.component.html - 241 + 250 Server src/app/components/manage/settings/settings.component.html - 249 + 258 No mail accounts defined. src/app/components/manage/settings/settings.component.html - 267 + 276 Mail rules src/app/components/manage/settings/settings.component.html - 271 + 282 Add Rule src/app/components/manage/settings/settings.component.html - 276 + 287 No mail rules defined. src/app/components/manage/settings/settings.component.html - 302 + 313 + + + + Users & Groups + + src/app/components/manage/settings/settings.component.html + 327 + + + + Users + + src/app/components/manage/settings/settings.component.html + 332 + + + + Add User + + src/app/components/manage/settings/settings.component.html + 337 + + + + Add Group + + src/app/components/manage/settings/settings.component.html + 372 Saved view "" deleted. src/app/components/manage/settings/settings.component.ts - 383 + 461 Settings saved src/app/components/manage/settings/settings.component.ts - 476 + 558 Settings were saved successfully. src/app/components/manage/settings/settings.component.ts - 477 + 559 Settings were saved successfully. Reload is required to apply some changes. src/app/components/manage/settings/settings.component.ts - 481 + 563 Reload now src/app/components/manage/settings/settings.component.ts - 482 + 564 Use system language src/app/components/manage/settings/settings.component.ts - 500 + 582 Use date format of display language src/app/components/manage/settings/settings.component.ts - 507 + 589 @@ -3772,133 +4175,217 @@ )"/> src/app/components/manage/settings/settings.component.ts - 527,529 + 609,611 + + + + Saved user "". + + src/app/components/manage/settings/settings.component.ts + 636 + + + + Error saving user: . + + src/app/components/manage/settings/settings.component.ts + 645 + + + + Confirm delete user account + + src/app/components/manage/settings/settings.component.ts + 655 + + + + This operation will permanently this user account. + + src/app/components/manage/settings/settings.component.ts + 656 + + + + Deleted user + + src/app/components/manage/settings/settings.component.ts + 665 + + + + Error deleting user: . + + src/app/components/manage/settings/settings.component.ts + 673 + + + + Saved group "". + + src/app/components/manage/settings/settings.component.ts + 691 + + + + Error saving group: . + + src/app/components/manage/settings/settings.component.ts + 699 + + + + Confirm delete user group + + src/app/components/manage/settings/settings.component.ts + 709 + + + + This operation will permanently this user group. + + src/app/components/manage/settings/settings.component.ts + 710 + + + + Deleted group + + src/app/components/manage/settings/settings.component.ts + 719 + + + + Error deleting group: . + + src/app/components/manage/settings/settings.component.ts + 727 Saved account "". src/app/components/manage/settings/settings.component.ts - 554 + 750 Error saving account: . src/app/components/manage/settings/settings.component.ts - 564 + 760 Confirm delete mail account src/app/components/manage/settings/settings.component.ts - 574 + 770 This operation will permanently delete this mail account. src/app/components/manage/settings/settings.component.ts - 575 + 771 Deleted mail account src/app/components/manage/settings/settings.component.ts - 584 + 780 Error deleting mail account: . src/app/components/manage/settings/settings.component.ts - 593 + 789 Saved rule "". src/app/components/manage/settings/settings.component.ts - 612 + 808 Error saving rule: . src/app/components/manage/settings/settings.component.ts - 623 + 819 Confirm delete mail rule src/app/components/manage/settings/settings.component.ts - 633 + 829 This operation will permanently delete this mail rule. src/app/components/manage/settings/settings.component.ts - 634 + 830 Deleted mail rule src/app/components/manage/settings/settings.component.ts - 643 + 839 Error deleting mail rule: . src/app/components/manage/settings/settings.component.ts - 652 + 848 storage path src/app/components/manage/storage-path-list/storage-path-list.component.ts - 30 + 36 storage paths src/app/components/manage/storage-path-list/storage-path-list.component.ts - 31 + 37 Do you really want to delete the storage path ""? src/app/components/manage/storage-path-list/storage-path-list.component.ts - 45 + 52 tag src/app/components/manage/tag-list/tag-list.component.ts - 30 + 36 tags src/app/components/manage/tag-list/tag-list.component.ts - 31 + 37 Do you really want to delete the tag ""? src/app/components/manage/tag-list/tag-list.component.ts - 46 + 53 @@ -3908,13 +4395,6 @@ 6 - - - - src/app/components/manage/tasks/tasks.component.html - 11 - - Refresh @@ -3944,74 +4424,74 @@ src/app/components/manage/tasks/tasks.component.ts - 56 + 62 Open Document src/app/components/manage/tasks/tasks.component.html - 86 + 87 Failed  src/app/components/manage/tasks/tasks.component.html - 103 + 105 Complete  src/app/components/manage/tasks/tasks.component.html - 109 + 111 Started  src/app/components/manage/tasks/tasks.component.html - 115 + 117 Queued  src/app/components/manage/tasks/tasks.component.html - 121 + 123 Dismiss selected src/app/components/manage/tasks/tasks.component.ts - 22 + 26 Dismiss all src/app/components/manage/tasks/tasks.component.ts - 23 + 27 src/app/components/manage/tasks/tasks.component.ts - 54 + 60 Confirm Dismiss All src/app/components/manage/tasks/tasks.component.ts - 52 + 58 tasks? src/app/components/manage/tasks/tasks.component.ts - 54 + 60 @@ -4113,7 +4593,7 @@ src/app/guards/dirty-saved-view.guard.ts - 24 + 32 src/app/services/open-documents.service.ts @@ -4153,21 +4633,28 @@ You have unsaved changes to the saved view src/app/guards/dirty-saved-view.guard.ts - 26 + 34 Are you sure you want to close this saved view? src/app/guards/dirty-saved-view.guard.ts - 30 + 38 Save and close src/app/guards/dirty-saved-view.guard.ts - 34 + 42 + + + + You don't have permissions to do that + + src/app/guards/permissions.guard.ts + 31 @@ -4347,210 +4834,210 @@ English (US) src/app/services/settings.service.ts - 145 + 162 Arabic src/app/services/settings.service.ts - 151 + 168 Belarusian src/app/services/settings.service.ts - 157 + 174 Czech src/app/services/settings.service.ts - 163 + 180 Danish src/app/services/settings.service.ts - 169 + 186 German src/app/services/settings.service.ts - 175 + 192 English (GB) src/app/services/settings.service.ts - 181 + 198 Spanish src/app/services/settings.service.ts - 187 + 204 French src/app/services/settings.service.ts - 193 + 210 Italian src/app/services/settings.service.ts - 199 + 216 Luxembourgish src/app/services/settings.service.ts - 205 + 222 Dutch src/app/services/settings.service.ts - 211 + 228 Polish src/app/services/settings.service.ts - 217 + 234 Portuguese (Brazil) src/app/services/settings.service.ts - 223 + 240 Portuguese src/app/services/settings.service.ts - 229 + 246 Romanian src/app/services/settings.service.ts - 235 + 252 Russian src/app/services/settings.service.ts - 241 + 258 Slovenian src/app/services/settings.service.ts - 247 + 264 Serbian src/app/services/settings.service.ts - 253 + 270 Swedish src/app/services/settings.service.ts - 259 + 276 Turkish src/app/services/settings.service.ts - 265 + 282 Chinese Simplified src/app/services/settings.service.ts - 271 + 288 ISO 8601 src/app/services/settings.service.ts - 288 + 305 Successfully completed one-time migratration of settings to the database! src/app/services/settings.service.ts - 399 + 416 Unable to migrate settings to the database, please try saving manually. src/app/services/settings.service.ts - 400 + 417 Information src/app/services/toast.service.ts - 36 + 43 Connecting... src/app/services/upload-documents.service.ts - 31 + 34 Uploading... src/app/services/upload-documents.service.ts - 43 + 46 Upload complete, waiting... src/app/services/upload-documents.service.ts - 46 + 49 HTTP error: src/app/services/upload-documents.service.ts - 62 + 65 diff --git a/src-ui/src/app/app-routing.module.ts b/src-ui/src/app/app-routing.module.ts index a3da2894c..6f26a81fd 100644 --- a/src-ui/src/app/app-routing.module.ts +++ b/src-ui/src/app/app-routing.module.ts @@ -14,8 +14,13 @@ import { DocumentAsnComponent } from './components/document-asn/document-asn.com import { DirtyFormGuard } from './guards/dirty-form.guard' import { StoragePathListComponent } from './components/manage/storage-path-list/storage-path-list.component' import { TasksComponent } from './components/manage/tasks/tasks.component' +import { PermissionsGuard } from './guards/permissions.guard' import { DirtyDocGuard } from './guards/dirty-doc.guard' import { DirtySavedViewGuard } from './guards/dirty-saved-view.guard' +import { + PermissionAction, + PermissionType, +} from './services/permissions.service' const routes: Routes = [ { path: '', redirectTo: 'dashboard', pathMatch: 'full' }, @@ -29,23 +34,137 @@ const routes: Routes = [ path: 'documents', component: DocumentListComponent, canDeactivate: [DirtySavedViewGuard], + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.Document, + }, + }, }, { path: 'view/:id', component: DocumentListComponent, canDeactivate: [DirtySavedViewGuard], + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.SavedView, + }, + }, + }, + { + path: 'documents/:id', + component: DocumentDetailComponent, + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.Document, + }, + }, + }, + { + path: 'asn/:id', + component: DocumentAsnComponent, + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.Document, + }, + }, + }, + { + path: 'tags', + component: TagListComponent, + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.Tag, + }, + }, + }, + { + path: 'documenttypes', + component: DocumentTypeListComponent, + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.DocumentType, + }, + }, + }, + { + path: 'correspondents', + component: CorrespondentListComponent, + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.Correspondent, + }, + }, + }, + { + path: 'storagepaths', + component: StoragePathListComponent, + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.StoragePath, + }, + }, + }, + { + path: 'logs', + component: LogsComponent, + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.Admin, + }, + }, }, - { path: 'documents/:id', component: DocumentDetailComponent }, - { path: 'asn/:id', component: DocumentAsnComponent }, - { path: 'tags', component: TagListComponent }, - { path: 'documenttypes', component: DocumentTypeListComponent }, - { path: 'correspondents', component: CorrespondentListComponent }, - { path: 'storagepaths', component: StoragePathListComponent }, - { path: 'logs', component: LogsComponent }, { path: 'settings', component: SettingsComponent, canDeactivate: [DirtyFormGuard], + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.UISettings, + }, + }, + }, + { + path: 'tasks', + component: TasksComponent, + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.PaperlessTask, + }, + }, + }, + { + path: 'settings/:section', + component: SettingsComponent, + canDeactivate: [DirtyFormGuard], + canActivate: [PermissionsGuard], + data: { + requiredPermission: { + action: PermissionAction.View, + type: PermissionType.UISettings, + }, + }, }, { path: 'settings/:section', diff --git a/src-ui/src/app/app.component.ts b/src-ui/src/app/app.component.ts index 9a6962ccf..01eac1297 100644 --- a/src-ui/src/app/app.component.ts +++ b/src-ui/src/app/app.component.ts @@ -9,6 +9,11 @@ import { NgxFileDropEntry } from 'ngx-file-drop' import { UploadDocumentsService } from './services/upload-documents.service' import { TasksService } from './services/tasks.service' import { TourService } from 'ngx-ui-tour-ng-bootstrap' +import { + PermissionAction, + PermissionsService, + PermissionType, +} from './services/permissions.service' @Component({ selector: 'app-root', @@ -32,7 +37,8 @@ export class AppComponent implements OnInit, OnDestroy { private uploadDocumentsService: UploadDocumentsService, private tasksService: TasksService, public tourService: TourService, - private renderer: Renderer2 + private renderer: Renderer2, + private permissionsService: PermissionsService ) { let anyWindow = window as any anyWindow.pdfWorkerSrc = 'assets/js/pdf.worker.min.js' @@ -74,15 +80,28 @@ export class AppComponent implements OnInit, OnDestroy { if ( this.showNotification(SETTINGS_KEYS.NOTIFICATIONS_CONSUMER_SUCCESS) ) { - this.toastService.show({ - title: $localize`Document added`, - delay: 10000, - content: $localize`Document ${status.filename} was added to paperless.`, - actionName: $localize`Open document`, - action: () => { - this.router.navigate(['documents', status.documentId]) - }, - }) + if ( + this.permissionsService.currentUserCan( + PermissionAction.View, + PermissionType.Document + ) + ) { + this.toastService.show({ + title: $localize`Document added`, + delay: 10000, + content: $localize`Document ${status.filename} was added to paperless.`, + actionName: $localize`Open document`, + action: () => { + this.router.navigate(['documents', status.documentId]) + }, + }) + } else { + this.toastService.show({ + title: $localize`Document added`, + delay: 10000, + content: $localize`Document ${status.filename} was added to paperless.`, + }) + } } }) @@ -225,7 +244,13 @@ export class AppComponent implements OnInit, OnDestroy { } public get dragDropEnabled(): boolean { - return !this.router.url.includes('dashboard') + return ( + !this.router.url.includes('dashboard') && + this.permissionsService.currentUserCan( + PermissionAction.Add, + PermissionType.Document + ) + ) } public fileOver() { diff --git a/src-ui/src/app/app.module.ts b/src-ui/src/app/app.module.ts index 16924729e..beb3b0935 100644 --- a/src-ui/src/app/app.module.ts +++ b/src-ui/src/app/app.module.ts @@ -42,6 +42,7 @@ import { CheckComponent } from './components/common/input/check/check.component' import { PasswordComponent } from './components/common/input/password/password.component' import { SaveViewConfigDialogComponent } from './components/document-list/save-view-config-dialog/save-view-config-dialog.component' import { TagsComponent } from './components/common/input/tags/tags.component' +import { IfPermissionsDirective } from './directives/if-permissions.directive' import { SortableDirective } from './directives/sortable.directive' import { CookieService } from 'ngx-cookie-service' import { CsrfInterceptor } from './interceptors/csrf.interceptor' @@ -70,6 +71,7 @@ import { ColorSliderModule } from 'ngx-color/slider' import { ColorComponent } from './components/common/input/color/color.component' import { DocumentAsnComponent } from './components/document-asn/document-asn.component' import { DocumentCommentsComponent } from './components/document-comments/document-comments.component' +import { PermissionsGuard } from './guards/permissions.guard' import { DirtyDocGuard } from './guards/dirty-doc.guard' import { DirtySavedViewGuard } from './guards/dirty-saved-view.guard' import { StoragePathListComponent } from './components/manage/storage-path-list/storage-path-list.component' @@ -77,8 +79,15 @@ import { StoragePathEditDialogComponent } from './components/common/edit-dialog/ import { SettingsService } from './services/settings.service' import { TasksComponent } from './components/manage/tasks/tasks.component' import { TourNgBootstrapModule } from 'ngx-ui-tour-ng-bootstrap' +import { UserEditDialogComponent } from './components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component' +import { GroupEditDialogComponent } from './components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component' +import { PermissionsSelectComponent } from './components/common/permissions-select/permissions-select.component' import { MailAccountEditDialogComponent } from './components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component' import { MailRuleEditDialogComponent } from './components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component' +import { PermissionsUserComponent } from './components/common/input/permissions/permissions-user/permissions-user.component' +import { PermissionsGroupComponent } from './components/common/input/permissions/permissions-group/permissions-group.component' +import { IfOwnerDirective } from './directives/if-owner.directive' +import { IfObjectPermissionsDirective } from './directives/if-object-permissions.directive' import localeAr from '@angular/common/locales/ar' import localeBe from '@angular/common/locales/be' @@ -100,6 +109,8 @@ import localeSr from '@angular/common/locales/sr' import localeSv from '@angular/common/locales/sv' import localeTr from '@angular/common/locales/tr' import localeZh from '@angular/common/locales/zh' +import { PermissionsDialogComponent } from './components/common/permissions-dialog/permissions-dialog.component' +import { PermissionsFormComponent } from './components/common/input/permissions/permissions-form/permissions-form.component' registerLocaleData(localeAr) registerLocaleData(localeBe) @@ -165,6 +176,7 @@ function initializeApp(settings: SettingsService) { PasswordComponent, SaveViewConfigDialogComponent, TagsComponent, + IfPermissionsDirective, SortableDirective, SavedViewWidgetComponent, StatisticsWidgetComponent, @@ -186,8 +198,17 @@ function initializeApp(settings: SettingsService) { DocumentAsnComponent, DocumentCommentsComponent, TasksComponent, + UserEditDialogComponent, + GroupEditDialogComponent, + PermissionsSelectComponent, MailAccountEditDialogComponent, MailRuleEditDialogComponent, + PermissionsUserComponent, + PermissionsGroupComponent, + IfOwnerDirective, + IfObjectPermissionsDirective, + PermissionsDialogComponent, + PermissionsFormComponent, ], imports: [ BrowserModule, @@ -225,6 +246,7 @@ function initializeApp(settings: SettingsService) { DocumentTitlePipe, { provide: NgbDateAdapter, useClass: ISODateAdapter }, { provide: NgbDateParserFormatter, useClass: LocalizedDateParserFormatter }, + PermissionsGuard, DirtyDocGuard, DirtySavedViewGuard, ], diff --git a/src-ui/src/app/components/app-frame/app-frame.component.html b/src-ui/src/app/components/app-frame/app-frame.component.html index 5115303d7..90e75be58 100644 --- a/src-ui/src/app/components/app-frame/app-frame.component.html +++ b/src-ui/src/app/components/app-frame/app-frame.component.html @@ -10,7 +10,7 @@ Paperless-ngx -
+
@@ -39,7 +39,7 @@

Logged in as {{this.settingsService.displayName}}

- + Settings @@ -72,7 +72,7 @@  Dashboard -
  • +
  • @@ -80,79 +80,82 @@
    • +
    +
    + Saved views + +
    + +
    -
    - Saved views - -
    - - -
    - Open documents -
    - +
    Manage
      -
    • +
    •  Correspondents
      • -
    • +
    •  Tags
      • -
    • +
    •  Document types
      • -
    • +
    •  Storage paths
      • -
    • +
    • {{tasksService.failedFileTasks.length}} @@ -160,14 +163,14 @@  File Tasks{{tasksService.failedFileTasks.length}}
      • -
    • +
    •  Logs
      • -
    • +
    • diff --git a/src-ui/src/app/components/app-frame/app-frame.component.ts b/src-ui/src/app/components/app-frame/app-frame.component.ts index 052751276..7167bce44 100644 --- a/src-ui/src/app/components/app-frame/app-frame.component.ts +++ b/src-ui/src/app/components/app-frame/app-frame.component.ts @@ -26,13 +26,17 @@ import { TasksService } from 'src/app/services/tasks.service' import { ComponentCanDeactivate } from 'src/app/guards/dirty-doc.guard' import { SETTINGS_KEYS } from 'src/app/data/paperless-uisettings' import { ToastService } from 'src/app/services/toast.service' +import { ComponentWithPermissions } from '../with-permissions/with-permissions.component' @Component({ selector: 'app-app-frame', templateUrl: './app-frame.component.html', styleUrls: ['./app-frame.component.scss'], }) -export class AppFrameComponent implements OnInit, ComponentCanDeactivate { +export class AppFrameComponent + extends ComponentWithPermissions + implements OnInit, ComponentCanDeactivate +{ constructor( public router: Router, private activatedRoute: ActivatedRoute, @@ -44,7 +48,9 @@ export class AppFrameComponent implements OnInit, ComponentCanDeactivate { public settingsService: SettingsService, public tasksService: TasksService, private readonly toastService: ToastService - ) {} + ) { + super() + } ngOnInit(): void { if (this.settingsService.get(SETTINGS_KEYS.UPDATE_CHECKING_ENABLED)) { diff --git a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts index 59d84bbe8..3cd90f2f4 100644 --- a/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts +++ b/src-ui/src/app/components/common/confirm-dialog/confirm-dialog.component.ts @@ -1,6 +1,6 @@ import { Component, EventEmitter, Input, Output } from '@angular/core' import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap' -import { interval, Subject, switchMap, take } from 'rxjs' +import { interval, Subject, take } from 'rxjs' @Component({ selector: 'app-confirm-dialog', diff --git a/src-ui/src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html b/src-ui/src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html index a11b6363e..b04cfb216 100644 --- a/src-ui/src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html +++ b/src-ui/src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.html @@ -5,10 +5,16 @@
      + + +
      + +
      +
      diff --git a/src-ui/src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.ts b/src-ui/src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.ts index 7361e5e4b..2ac7f2d99 100644 --- a/src-ui/src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component.ts @@ -5,6 +5,7 @@ import { EditDialogComponent } from 'src/app/components/common/edit-dialog/edit- import { DEFAULT_MATCHING_ALGORITHM } from 'src/app/data/matching-model' import { PaperlessCorrespondent } from 'src/app/data/paperless-correspondent' import { CorrespondentService } from 'src/app/services/rest/correspondent.service' +import { UserService } from 'src/app/services/rest/user.service' @Component({ selector: 'app-correspondent-edit-dialog', @@ -12,8 +13,12 @@ import { CorrespondentService } from 'src/app/services/rest/correspondent.servic styleUrls: ['./correspondent-edit-dialog.component.scss'], }) export class CorrespondentEditDialogComponent extends EditDialogComponent { - constructor(service: CorrespondentService, activeModal: NgbActiveModal) { - super(service, activeModal) + constructor( + service: CorrespondentService, + activeModal: NgbActiveModal, + userService: UserService + ) { + super(service, activeModal, userService) } getCreateTitle() { @@ -30,6 +35,7 @@ export class CorrespondentEditDialogComponent extends EditDialogComponent
      - - - - +
      + + + + +
      + +
      + +
      diff --git a/src-ui/src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.ts b/src-ui/src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.ts index d565e66e1..a1d3e4fc4 100644 --- a/src-ui/src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/edit-dialog/document-type-edit-dialog/document-type-edit-dialog.component.ts @@ -5,6 +5,7 @@ import { EditDialogComponent } from 'src/app/components/common/edit-dialog/edit- import { DEFAULT_MATCHING_ALGORITHM } from 'src/app/data/matching-model' import { PaperlessDocumentType } from 'src/app/data/paperless-document-type' import { DocumentTypeService } from 'src/app/services/rest/document-type.service' +import { UserService } from 'src/app/services/rest/user.service' @Component({ selector: 'app-document-type-edit-dialog', @@ -12,8 +13,12 @@ import { DocumentTypeService } from 'src/app/services/rest/document-type.service styleUrls: ['./document-type-edit-dialog.component.scss'], }) export class DocumentTypeEditDialogComponent extends EditDialogComponent { - constructor(service: DocumentTypeService, activeModal: NgbActiveModal) { - super(service, activeModal) + constructor( + service: DocumentTypeService, + activeModal: NgbActiveModal, + userService: UserService + ) { + super(service, activeModal, userService) } getCreateTitle() { @@ -30,6 +35,7 @@ export class DocumentTypeEditDialogComponent extends EditDialogComponent - implements OnInit +export abstract class EditDialogComponent< + T extends ObjectWithPermissions | ObjectWithId +> implements OnInit { constructor( private service: AbstractPaperlessService, - private activeModal: NgbActiveModal + private activeModal: NgbActiveModal, + private userService: UserService ) {} + users: PaperlessUser[] + @Input() dialogMode: string = 'create' @@ -36,6 +44,14 @@ export abstract class EditDialogComponent ngOnInit(): void { if (this.object != null) { + if (this.object['permissions']) { + this.object['set_permissions'] = this.object['permissions'] + } + + this.object['permissions_form'] = { + owner: (this.object as ObjectWithPermissions).owner, + set_permissions: (this.object as ObjectWithPermissions).permissions, + } this.objectForm.patchValue(this.object) } @@ -43,6 +59,8 @@ export abstract class EditDialogComponent setTimeout(() => { this.closeEnabled = true }) + + this.userService.listAll().subscribe((r) => (this.users = r.results)) } getCreateTitle() { @@ -77,10 +95,16 @@ export abstract class EditDialogComponent } save() { - var newObject = Object.assign( - Object.assign({}, this.object), - this.objectForm.value - ) + const formValues = Object.assign({}, this.objectForm.value) + const permissionsObject: PermissionsFormObject = + this.objectForm.get('permissions_form')?.value + if (permissionsObject) { + formValues.owner = permissionsObject.owner + formValues.set_permissions = permissionsObject.set_permissions + delete formValues.permissions_form + } + + var newObject = Object.assign(Object.assign({}, this.object), formValues) var serverResponse: Observable switch (this.dialogMode) { case 'create': diff --git a/src-ui/src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.html b/src-ui/src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.html new file mode 100644 index 000000000..97124a05f --- /dev/null +++ b/src-ui/src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.html @@ -0,0 +1,19 @@ + +
      + + +
      +
      +
      +
      + + +
      +
      +
      +
      + + +
      + diff --git a/src-ui/src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.scss b/src-ui/src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.scss new file mode 100644 index 000000000..e69de29bb diff --git a/src-ui/src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.ts b/src-ui/src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.ts new file mode 100644 index 000000000..785d6c20d --- /dev/null +++ b/src-ui/src/app/components/common/edit-dialog/group-edit-dialog/group-edit-dialog.component.ts @@ -0,0 +1,37 @@ +import { Component } from '@angular/core' +import { FormControl, FormGroup } from '@angular/forms' +import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap' +import { EditDialogComponent } from 'src/app/components/common/edit-dialog/edit-dialog.component' +import { PaperlessGroup } from 'src/app/data/paperless-group' +import { GroupService } from 'src/app/services/rest/group.service' +import { UserService } from 'src/app/services/rest/user.service' + +@Component({ + selector: 'app-group-edit-dialog', + templateUrl: './group-edit-dialog.component.html', + styleUrls: ['./group-edit-dialog.component.scss'], +}) +export class GroupEditDialogComponent extends EditDialogComponent { + constructor( + service: GroupService, + activeModal: NgbActiveModal, + userService: UserService + ) { + super(service, activeModal, userService) + } + + getCreateTitle() { + return $localize`Create new user group` + } + + getEditTitle() { + return $localize`Edit user group` + } + + getForm(): FormGroup { + return new FormGroup({ + name: new FormControl(''), + permissions: new FormControl(null), + }) + } +} diff --git a/src-ui/src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts b/src-ui/src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts index b2edb9219..1c42ffeb0 100644 --- a/src-ui/src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component.ts @@ -7,6 +7,7 @@ import { PaperlessMailAccount, } from 'src/app/data/paperless-mail-account' import { MailAccountService } from 'src/app/services/rest/mail-account.service' +import { UserService } from 'src/app/services/rest/user.service' const IMAP_SECURITY_OPTIONS = [ { id: IMAPSecurity.None, name: $localize`No encryption` }, @@ -20,8 +21,12 @@ const IMAP_SECURITY_OPTIONS = [ styleUrls: ['./mail-account-edit-dialog.component.scss'], }) export class MailAccountEditDialogComponent extends EditDialogComponent { - constructor(service: MailAccountService, activeModal: NgbActiveModal) { - super(service, activeModal) + constructor( + service: MailAccountService, + activeModal: NgbActiveModal, + userService: UserService + ) { + super(service, activeModal, userService) } getCreateTitle() { diff --git a/src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts b/src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts index 0a0f2837d..25821242a 100644 --- a/src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component.ts @@ -18,6 +18,7 @@ import { CorrespondentService } from 'src/app/services/rest/correspondent.servic import { DocumentTypeService } from 'src/app/services/rest/document-type.service' import { MailAccountService } from 'src/app/services/rest/mail-account.service' import { MailRuleService } from 'src/app/services/rest/mail-rule.service' +import { UserService } from 'src/app/services/rest/user.service' const ATTACHMENT_TYPE_OPTIONS = [ { @@ -113,9 +114,10 @@ export class MailRuleEditDialogComponent extends EditDialogComponent
      -

      - Note that editing a path does not apply changes to stored files until you have run the 'document_renamer' utility. See the documentation. -

      - +
      + +
      +
      diff --git a/src-ui/src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts b/src-ui/src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts index 1dfef00c5..edb144a59 100644 --- a/src-ui/src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component.ts @@ -5,6 +5,7 @@ import { EditDialogComponent } from 'src/app/components/common/edit-dialog/edit- import { DEFAULT_MATCHING_ALGORITHM } from 'src/app/data/matching-model' import { PaperlessStoragePath } from 'src/app/data/paperless-storage-path' import { StoragePathService } from 'src/app/services/rest/storage-path.service' +import { UserService } from 'src/app/services/rest/user.service' @Component({ selector: 'app-storage-path-edit-dialog', @@ -12,8 +13,12 @@ import { StoragePathService } from 'src/app/services/rest/storage-path.service' styleUrls: ['./storage-path-edit-dialog.component.scss'], }) export class StoragePathEditDialogComponent extends EditDialogComponent { - constructor(service: StoragePathService, activeModal: NgbActiveModal) { - super(service, activeModal) + constructor( + service: StoragePathService, + activeModal: NgbActiveModal, + userService: UserService + ) { + super(service, activeModal, userService) } get pathHint() { @@ -41,6 +46,7 @@ export class StoragePathEditDialogComponent extends EditDialogComponent + +
      + +
      +
      diff --git a/src-ui/src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.ts b/src-ui/src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.ts index db106d990..a0d0dd17d 100644 --- a/src-ui/src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.ts +++ b/src-ui/src/app/components/common/edit-dialog/tag-edit-dialog/tag-edit-dialog.component.ts @@ -6,6 +6,7 @@ import { PaperlessTag } from 'src/app/data/paperless-tag' import { TagService } from 'src/app/services/rest/tag.service' import { randomColor } from 'src/app/utils/color' import { DEFAULT_MATCHING_ALGORITHM } from 'src/app/data/matching-model' +import { UserService } from 'src/app/services/rest/user.service' @Component({ selector: 'app-tag-edit-dialog', @@ -13,8 +14,12 @@ import { DEFAULT_MATCHING_ALGORITHM } from 'src/app/data/matching-model' styleUrls: ['./tag-edit-dialog.component.scss'], }) export class TagEditDialogComponent extends EditDialogComponent { - constructor(service: TagService, activeModal: NgbActiveModal) { - super(service, activeModal) + constructor( + service: TagService, + activeModal: NgbActiveModal, + userService: UserService + ) { + super(service, activeModal, userService) } getCreateTitle() { @@ -33,6 +38,7 @@ export class TagEditDialogComponent extends EditDialogComponent { matching_algorithm: new FormControl(DEFAULT_MATCHING_ALGORITHM), match: new FormControl(''), is_insensitive: new FormControl(true), + permissions_form: new FormControl(null), }) } } diff --git a/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html b/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html new file mode 100644 index 000000000..ec9cceae9 --- /dev/null +++ b/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.html @@ -0,0 +1,38 @@ +
      +
      + + +
      +
      +
      +
      + + + + + + +
      +
      + + +
      +
      + + +
      +
      + + +
      +
      + +
      +
      +
      +
      + + +
      +
      diff --git a/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.scss b/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.scss new file mode 100644 index 000000000..e69de29bb diff --git a/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.ts b/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.ts new file mode 100644 index 000000000..8adf6f324 --- /dev/null +++ b/src-ui/src/app/components/common/edit-dialog/user-edit-dialog/user-edit-dialog.component.ts @@ -0,0 +1,79 @@ +import { Component, OnInit } from '@angular/core' +import { FormControl, FormGroup } from '@angular/forms' +import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap' +import { first } from 'rxjs' +import { EditDialogComponent } from 'src/app/components/common/edit-dialog/edit-dialog.component' +import { PaperlessGroup } from 'src/app/data/paperless-group' +import { PaperlessUser } from 'src/app/data/paperless-user' +import { GroupService } from 'src/app/services/rest/group.service' +import { UserService } from 'src/app/services/rest/user.service' + +@Component({ + selector: 'app-user-edit-dialog', + templateUrl: './user-edit-dialog.component.html', + styleUrls: ['./user-edit-dialog.component.scss'], +}) +export class UserEditDialogComponent + extends EditDialogComponent + implements OnInit +{ + groups: PaperlessGroup[] + + constructor( + service: UserService, + activeModal: NgbActiveModal, + groupsService: GroupService + ) { + super(service, activeModal, service) + + groupsService + .listAll() + .pipe(first()) + .subscribe((result) => (this.groups = result.results)) + } + + ngOnInit(): void { + super.ngOnInit() + this.onToggleSuperUser() + } + + getCreateTitle() { + return $localize`Create new user account` + } + + getEditTitle() { + return $localize`Edit user account` + } + + getForm(): FormGroup { + return new FormGroup({ + username: new FormControl(''), + email: new FormControl(''), + password: new FormControl(null), + first_name: new FormControl(''), + last_name: new FormControl(''), + is_active: new FormControl(true), + is_superuser: new FormControl(false), + groups: new FormControl([]), + user_permissions: new FormControl([]), + }) + } + + onToggleSuperUser() { + if (this.objectForm.get('is_superuser').value) { + this.objectForm.get('user_permissions').disable() + } else { + this.objectForm.get('user_permissions').enable() + } + } + + get inheritedPermissions(): string[] { + const groupsVal: Array = this.objectForm.get('groups').value + + if (!groupsVal) return [] + else + return groupsVal.flatMap( + (id) => this.groups.find((g) => g.id == id)?.permissions + ) + } +} diff --git a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.html b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.html index e82d17334..b3d107e8a 100644 --- a/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.html +++ b/src-ui/src/app/components/common/filterable-dropdown/filterable-dropdown.component.html @@ -1,5 +1,5 @@
      -
      - +
      - + +
      {{error}} diff --git a/src-ui/src/app/components/common/input/permissions/permissions-form/permissions-form.component.html b/src-ui/src/app/components/common/input/permissions/permissions-form/permissions-form.component.html new file mode 100644 index 000000000..d7ae5ee7b --- /dev/null +++ b/src-ui/src/app/components/common/input/permissions/permissions-form/permissions-form.component.html @@ -0,0 +1,68 @@ + +
      Permissions
      + +       + + + + + + + + + + + +
      +
      +
      + +
      +
      + +
      +
      + Objects without an owner can be viewed and edited by all users +
      +
      View
      +
      +
      +
      + +
      +
      + +
      +
      +
      +
      + +
      +
      + +
      +
      +
      +
      Edit
      +
      +
      +
      + +
      +
      + +
      +
      +
      +
      + +
      +
      + +
      +
      + Edit permissions also grant viewing permissions +
      +
      +
      +       diff --git a/src-ui/src/app/components/common/input/permissions/permissions-form/permissions-form.component.scss b/src-ui/src/app/components/common/input/permissions/permissions-form/permissions-form.component.scss new file mode 100644 index 000000000..e69de29bb diff --git a/src-ui/src/app/components/common/input/permissions/permissions-form/permissions-form.component.ts b/src-ui/src/app/components/common/input/permissions/permissions-form/permissions-form.component.ts new file mode 100644 index 000000000..8fcde88cb --- /dev/null +++ b/src-ui/src/app/components/common/input/permissions/permissions-form/permissions-form.component.ts @@ -0,0 +1,69 @@ +import { Component, forwardRef, Input, OnInit } from '@angular/core' +import { FormControl, FormGroup, NG_VALUE_ACCESSOR } from '@angular/forms' +import { PaperlessUser } from 'src/app/data/paperless-user' +import { AbstractInputComponent } from '../../abstract-input' + +export interface PermissionsFormObject { + owner?: number + set_permissions?: { + view?: { + users?: number[] + groups?: number[] + } + change?: { + users?: number[] + groups?: number[] + } + } +} + +@Component({ + providers: [ + { + provide: NG_VALUE_ACCESSOR, + useExisting: forwardRef(() => PermissionsFormComponent), + multi: true, + }, + ], + selector: 'app-permissions-form', + templateUrl: './permissions-form.component.html', + styleUrls: ['./permissions-form.component.scss'], +}) +export class PermissionsFormComponent + extends AbstractInputComponent + implements OnInit +{ + @Input() + users: PaperlessUser[] + + @Input() + accordion: boolean = false + + form = new FormGroup({ + owner: new FormControl(null), + set_permissions: new FormGroup({ + view: new FormGroup({ + users: new FormControl([]), + groups: new FormControl([]), + }), + change: new FormGroup({ + users: new FormControl([]), + groups: new FormControl([]), + }), + }), + }) + + constructor() { + super() + } + + ngOnInit(): void { + this.form.valueChanges.subscribe((value) => { + this.onChange(value) + }) + } + + writeValue(newValue: any): void { + this.form.patchValue(newValue, { emitEvent: false }) + } +} diff --git a/src-ui/src/app/components/common/input/permissions/permissions-group/permissions-group.component.html b/src-ui/src/app/components/common/input/permissions/permissions-group/permissions-group.component.html new file mode 100644 index 000000000..5ff0fa894 --- /dev/null +++ b/src-ui/src/app/components/common/input/permissions/permissions-group/permissions-group.component.html @@ -0,0 +1,13 @@ +
      +
      + + +
      +
      diff --git a/src-ui/src/app/components/common/input/permissions/permissions-group/permissions-group.component.scss b/src-ui/src/app/components/common/input/permissions/permissions-group/permissions-group.component.scss new file mode 100644 index 000000000..e69de29bb diff --git a/src-ui/src/app/components/common/input/permissions/permissions-group/permissions-group.component.ts b/src-ui/src/app/components/common/input/permissions/permissions-group/permissions-group.component.ts new file mode 100644 index 000000000..f047ac6c2 --- /dev/null +++ b/src-ui/src/app/components/common/input/permissions/permissions-group/permissions-group.component.ts @@ -0,0 +1,30 @@ +import { Component, forwardRef, Input, OnInit } from '@angular/core' +import { NG_VALUE_ACCESSOR } from '@angular/forms' +import { first } from 'rxjs/operators' +import { PaperlessGroup } from 'src/app/data/paperless-group' +import { GroupService } from 'src/app/services/rest/group.service' +import { AbstractInputComponent } from '../../abstract-input' + +@Component({ + providers: [ + { + provide: NG_VALUE_ACCESSOR, + useExisting: forwardRef(() => PermissionsGroupComponent), + multi: true, + }, + ], + selector: 'app-permissions-group', + templateUrl: './permissions-group.component.html', + styleUrls: ['./permissions-group.component.scss'], +}) +export class PermissionsGroupComponent extends AbstractInputComponent { + groups: PaperlessGroup[] + + constructor(groupService: GroupService) { + super() + groupService + .listAll() + .pipe(first()) + .subscribe((result) => (this.groups = result.results)) + } +} diff --git a/src-ui/src/app/components/common/input/permissions/permissions-user/permissions-user.component.html b/src-ui/src/app/components/common/input/permissions/permissions-user/permissions-user.component.html new file mode 100644 index 000000000..fdb832cf1 --- /dev/null +++ b/src-ui/src/app/components/common/input/permissions/permissions-user/permissions-user.component.html @@ -0,0 +1,13 @@ +
      +
      + + +
      +
      diff --git a/src-ui/src/app/components/common/input/permissions/permissions-user/permissions-user.component.scss b/src-ui/src/app/components/common/input/permissions/permissions-user/permissions-user.component.scss new file mode 100644 index 000000000..e69de29bb diff --git a/src-ui/src/app/components/common/input/permissions/permissions-user/permissions-user.component.ts b/src-ui/src/app/components/common/input/permissions/permissions-user/permissions-user.component.ts new file mode 100644 index 000000000..5c08a06a2 --- /dev/null +++ b/src-ui/src/app/components/common/input/permissions/permissions-user/permissions-user.component.ts @@ -0,0 +1,38 @@ +import { Component, forwardRef, Input, OnInit } from '@angular/core' +import { NG_VALUE_ACCESSOR } from '@angular/forms' +import { first } from 'rxjs/operators' +import { PaperlessUser } from 'src/app/data/paperless-user' +import { UserService } from 'src/app/services/rest/user.service' +import { SettingsService } from 'src/app/services/settings.service' +import { AbstractInputComponent } from '../../abstract-input' + +@Component({ + providers: [ + { + provide: NG_VALUE_ACCESSOR, + useExisting: forwardRef(() => PermissionsUserComponent), + multi: true, + }, + ], + selector: 'app-permissions-user', + templateUrl: './permissions-user.component.html', + styleUrls: ['./permissions-user.component.scss'], +}) +export class PermissionsUserComponent extends AbstractInputComponent< + PaperlessUser[] +> { + users: PaperlessUser[] + + constructor(userService: UserService, settings: SettingsService) { + super() + userService + .listAll() + .pipe(first()) + .subscribe( + (result) => + (this.users = result.results.filter( + (u) => u.id !== settings.currentUser.id + )) + ) + } +} diff --git a/src-ui/src/app/components/common/input/select/select.component.html b/src-ui/src/app/components/common/input/select/select.component.html index b111e1656..aa005fb1f 100644 --- a/src-ui/src/app/components/common/input/select/select.component.html +++ b/src-ui/src/app/components/common/input/select/select.component.html @@ -1,5 +1,5 @@ -
      - +
      +
      - +
      +
      + +

      + +
      + +
      + +
      +
      + + +
      diff --git a/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.scss b/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.scss new file mode 100644 index 000000000..e69de29bb diff --git a/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.ts b/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.ts new file mode 100644 index 000000000..0bac3120d --- /dev/null +++ b/src-ui/src/app/components/common/permissions-dialog/permissions-dialog.component.ts @@ -0,0 +1,46 @@ +import { Component, EventEmitter, Input, Output } from '@angular/core' +import { FormControl, FormGroup } from '@angular/forms' +import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap' +import { PaperlessUser } from 'src/app/data/paperless-user' +import { UserService } from 'src/app/services/rest/user.service' + +@Component({ + selector: 'app-permissions-dialog', + templateUrl: './permissions-dialog.component.html', + styleUrls: ['./permissions-dialog.component.scss'], +}) +export class PermissionsDialogComponent { + users: PaperlessUser[] + + constructor( + public activeModal: NgbActiveModal, + private userService: UserService + ) { + this.userService.listAll().subscribe((r) => (this.users = r.results)) + } + + @Output() + public confirmClicked = new EventEmitter() + + @Input() + title = $localize`Set Permissions` + + form = new FormGroup({ + permissions_form: new FormControl(), + }) + + get permissions() { + return { + owner: this.form.get('permissions_form').value?.owner ?? null, + set_permissions: + this.form.get('permissions_form').value?.set_permissions ?? null, + } + } + + @Input() + message = $localize`Note that permissions set here will override any existing permissions` + + cancelClicked() { + this.activeModal.close() + } +} diff --git a/src-ui/src/app/components/common/permissions-select/permissions-select.component.html b/src-ui/src/app/components/common/permissions-select/permissions-select.component.html new file mode 100644 index 000000000..1907f4e3f --- /dev/null +++ b/src-ui/src/app/components/common/permissions-select/permissions-select.component.html @@ -0,0 +1,27 @@ +
      + +
        +
      • +
        Type
        +
        All
        +
        Add
        +
        Change
        +
        Delete
        +
        View
        +
        • +
      • +
        {{type.key}}:
        + +
        + + +
        + +
        + + +
        +
        • +
        {{error}}
        +
      +
      diff --git a/src-ui/src/app/components/common/permissions-select/permissions-select.component.scss b/src-ui/src/app/components/common/permissions-select/permissions-select.component.scss new file mode 100644 index 000000000..e69de29bb diff --git a/src-ui/src/app/components/common/permissions-select/permissions-select.component.ts b/src-ui/src/app/components/common/permissions-select/permissions-select.component.ts new file mode 100644 index 000000000..74e8a73c4 --- /dev/null +++ b/src-ui/src/app/components/common/permissions-select/permissions-select.component.ts @@ -0,0 +1,189 @@ +import { Component, forwardRef, Input, OnInit } from '@angular/core' +import { + ControlValueAccessor, + FormControl, + FormGroup, + NG_VALUE_ACCESSOR, +} from '@angular/forms' +import { + PermissionAction, + PermissionsService, + PermissionType, +} from 'src/app/services/permissions.service' + +@Component({ + providers: [ + { + provide: NG_VALUE_ACCESSOR, + useExisting: forwardRef(() => PermissionsSelectComponent), + multi: true, + }, + ], + selector: 'app-permissions-select', + templateUrl: './permissions-select.component.html', + styleUrls: ['./permissions-select.component.scss'], +}) +export class PermissionsSelectComponent + implements OnInit, ControlValueAccessor +{ + PermissionType = PermissionType + PermissionAction = PermissionAction + + @Input() + title: string = 'Permissions' + + @Input() + error: string + + permissions: string[] + + form = new FormGroup({}) + + typesWithAllActions: Set = new Set() + + _inheritedPermissions: string[] = [] + + @Input() + set inheritedPermissions(inherited: string[]) { + // remove . from permission strings + const newInheritedPermissions = inherited?.length + ? inherited.map((p) => p.replace(/^\w+\./g, '')) + : [] + + if (this._inheritedPermissions !== newInheritedPermissions) { + this._inheritedPermissions = newInheritedPermissions + this.writeValue(this.permissions) // updates visual checks etc. + } + } + + inheritedWarning: string = $localize`Inerhited from group` + + constructor(private readonly permissionsService: PermissionsService) { + for (const type in PermissionType) { + const control = new FormGroup({}) + for (const action in PermissionAction) { + control.addControl(action, new FormControl(null)) + } + this.form.addControl(type, control) + } + } + + writeValue(permissions: string[]): void { + this.permissions = permissions ?? [] + const allPerms = this._inheritedPermissions.concat(this.permissions) + + allPerms.forEach((permissionStr) => { + const { actionKey, typeKey } = + this.permissionsService.getPermissionKeys(permissionStr) + + if (actionKey && typeKey) { + if (this.form.get(typeKey)?.get(actionKey)) { + this.form + .get(typeKey) + .get(actionKey) + .patchValue(true, { emitEvent: false }) + } + } + }) + Object.keys(PermissionType).forEach((type) => { + if ( + Object.values(this.form.get(type).value).every((val) => val == true) + ) { + this.typesWithAllActions.add(type) + } else { + this.typesWithAllActions.delete(type) + } + }) + } + + onChange = (newValue: string[]) => {} + + onTouched = () => {} + + disabled: boolean = false + + registerOnChange(fn: any): void { + this.onChange = fn + } + + registerOnTouched(fn: any): void { + this.onTouched = fn + } + + setDisabledState?(isDisabled: boolean): void { + this.disabled = isDisabled + } + + ngOnInit(): void { + this.form.valueChanges.subscribe((newValue) => { + let permissions = [] + Object.entries(newValue).forEach(([typeKey, typeValue]) => { + // e.g. [Document, { Add: true, View: true ... }] + const selectedActions = Object.entries(typeValue).filter( + ([actionKey, actionValue]) => actionValue == true + ) + + selectedActions.forEach(([actionKey, actionValue]) => { + permissions.push( + (PermissionType[typeKey] as string).replace( + '%s', + PermissionAction[actionKey] + ) + ) + }) + + if (selectedActions.length == Object.entries(typeValue).length) { + this.typesWithAllActions.add(typeKey) + } else { + this.typesWithAllActions.delete(typeKey) + } + }) + this.onChange(permissions) + }) + } + + toggleAll(event, type) { + const typeGroup = this.form.get(type) + if (event.target.checked) { + Object.keys(PermissionAction).forEach((action) => { + typeGroup.get(action).patchValue(true) + }) + this.typesWithAllActions.add(type) + } else { + Object.keys(PermissionAction).forEach((action) => { + typeGroup.get(action).patchValue(false) + }) + this.typesWithAllActions.delete(type) + } + } + + isInherited(typeKey: string, actionKey: string = null) { + if (this._inheritedPermissions.length == 0) return false + else if (actionKey) { + return this._inheritedPermissions.includes( + this.permissionsService.getPermissionCode( + PermissionAction[actionKey], + PermissionType[typeKey] + ) + ) + } else { + return Object.values(PermissionAction).every((action) => { + return this._inheritedPermissions.includes( + this.permissionsService.getPermissionCode( + action as PermissionAction, + PermissionType[typeKey] + ) + ) + }) + } + } + + // if checkbox is disabled either because "All", inhereted or entire component disabled + isDisabled(typeKey: string, actionKey: string) { + return this.typesWithAllActions.has(typeKey) || + this.isInherited(typeKey, actionKey) || + this.disabled + ? true + : null + } +} diff --git a/src-ui/src/app/components/common/toasts/toasts.component.scss b/src-ui/src/app/components/common/toasts/toasts.component.scss index e6dcb7a57..52f8f8957 100644 --- a/src-ui/src/app/components/common/toasts/toasts.component.scss +++ b/src-ui/src/app/components/common/toasts/toasts.component.scss @@ -9,3 +9,14 @@ .toast:not(.show) { display: block; // this corrects an ng-bootstrap bug that prevented animations } + +::ng-deep .toast.error .toast-header { + background-color: hsla(350, 79%, 40%, 0.8); // bg-danger + border-color: black; +} + +::ng-deep .toast.error .toast-body { + background-color: hsla(350, 79%, 40%, 0.8); // bg-danger + border-bottom-left-radius: inherit; + border-bottom-right-radius: inherit; +} diff --git a/src-ui/src/app/components/dashboard/dashboard.component.html b/src-ui/src/app/components/dashboard/dashboard.component.html index 6f408d3cf..5ddcada9d 100644 --- a/src-ui/src/app/components/dashboard/dashboard.component.html +++ b/src-ui/src/app/components/dashboard/dashboard.component.html @@ -28,12 +28,14 @@ - - - - - - +
      + + + + + + +
      diff --git a/src-ui/src/app/components/dashboard/dashboard.component.ts b/src-ui/src/app/components/dashboard/dashboard.component.ts index bb01f130e..f2eddae37 100644 --- a/src-ui/src/app/components/dashboard/dashboard.component.ts +++ b/src-ui/src/app/components/dashboard/dashboard.component.ts @@ -1,17 +1,20 @@ import { Component } from '@angular/core' import { SavedViewService } from 'src/app/services/rest/saved-view.service' import { SettingsService } from 'src/app/services/settings.service' +import { ComponentWithPermissions } from '../with-permissions/with-permissions.component' @Component({ selector: 'app-dashboard', templateUrl: './dashboard.component.html', styleUrls: ['./dashboard.component.scss'], }) -export class DashboardComponent { +export class DashboardComponent extends ComponentWithPermissions { constructor( public savedViewService: SavedViewService, public settingsService: SettingsService - ) {} + ) { + super() + } get subtitle() { if (this.settingsService.displayName) { diff --git a/src-ui/src/app/components/dashboard/widgets/saved-view-widget/saved-view-widget.component.html b/src-ui/src/app/components/dashboard/widgets/saved-view-widget/saved-view-widget.component.html index 32ca3859e..ededd7c52 100644 --- a/src-ui/src/app/components/dashboard/widgets/saved-view-widget/saved-view-widget.component.html +++ b/src-ui/src/app/components/dashboard/widgets/saved-view-widget/saved-view-widget.component.html @@ -1,6 +1,6 @@ - Show all + Show all @@ -10,7 +10,7 @@ - + diff --git a/src-ui/src/app/components/dashboard/widgets/saved-view-widget/saved-view-widget.component.ts b/src-ui/src/app/components/dashboard/widgets/saved-view-widget/saved-view-widget.component.ts index 5e30ff8cd..eab0439a5 100644 --- a/src-ui/src/app/components/dashboard/widgets/saved-view-widget/saved-view-widget.component.ts +++ b/src-ui/src/app/components/dashboard/widgets/saved-view-widget/saved-view-widget.component.ts @@ -9,13 +9,17 @@ import { PaperlessTag } from 'src/app/data/paperless-tag' import { FILTER_HAS_TAGS_ALL } from 'src/app/data/filter-rule-type' import { OpenDocumentsService } from 'src/app/services/open-documents.service' import { DocumentListViewService } from 'src/app/services/document-list-view.service' +import { ComponentWithPermissions } from 'src/app/components/with-permissions/with-permissions.component' @Component({ selector: 'app-saved-view-widget', templateUrl: './saved-view-widget.component.html', styleUrls: ['./saved-view-widget.component.scss'], }) -export class SavedViewWidgetComponent implements OnInit, OnDestroy { +export class SavedViewWidgetComponent + extends ComponentWithPermissions + implements OnInit, OnDestroy +{ loading: boolean = true constructor( @@ -24,7 +28,9 @@ export class SavedViewWidgetComponent implements OnInit, OnDestroy { private list: DocumentListViewService, private consumerStatusService: ConsumerStatusService, public openDocumentsService: OpenDocumentsService - ) {} + ) { + super() + } @Input() savedView: PaperlessSavedView @@ -74,6 +80,7 @@ export class SavedViewWidgetComponent implements OnInit, OnDestroy { clickTag(tag: PaperlessTag, event: MouseEvent) { event.preventDefault() + event.stopImmediatePropagation() this.list.quickFilter([ { rule_type: FILTER_HAS_TAGS_ALL, value: tag.id.toString() }, diff --git a/src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.html b/src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.html index 50fa8a754..cf79172bc 100644 --- a/src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.html +++ b/src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.html @@ -9,7 +9,7 @@
      -
      + {{status.filename}}

      {{status.message}}

      -
      - +
      +
      + +
      diff --git a/src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts b/src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts index f59be5da9..2c6bf38e2 100644 --- a/src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts +++ b/src-ui/src/app/components/dashboard/widgets/upload-file-widget/upload-file-widget.component.ts @@ -1,5 +1,6 @@ import { Component } from '@angular/core' import { NgxFileDropEntry } from 'ngx-file-drop' +import { ComponentWithPermissions } from 'src/app/components/with-permissions/with-permissions.component' import { ConsumerStatusService, FileStatus, @@ -14,13 +15,15 @@ const MAX_ALERTS = 5 templateUrl: './upload-file-widget.component.html', styleUrls: ['./upload-file-widget.component.scss'], }) -export class UploadFileWidgetComponent { +export class UploadFileWidgetComponent extends ComponentWithPermissions { alertsExpanded = false constructor( private consumerStatusService: ConsumerStatusService, private uploadDocumentsService: UploadDocumentsService - ) {} + ) { + super() + } getStatus() { return this.consumerStatusService.getConsumerStatus().slice(0, MAX_ALERTS) diff --git a/src-ui/src/app/components/document-comments/document-comments.component.html b/src-ui/src/app/components/document-comments/document-comments.component.html index 78467dd7d..576f46d79 100644 --- a/src-ui/src/app/components/document-comments/document-comments.component.html +++ b/src-ui/src/app/components/document-comments/document-comments.component.html @@ -1,5 +1,5 @@
      - +
      @@ -18,7 +18,7 @@
      {{displayName(comment)}} - {{ comment.created | customDate}} -
      - +
      Download original
      @@ -28,7 +28,7 @@
      -   -   -   + +   +   +   +
      diff --git a/src-ui/src/app/components/document-detail/document-detail.component.ts b/src-ui/src/app/components/document-detail/document-detail.component.ts index 19f85398b..33a0d4114 100644 --- a/src-ui/src/app/components/document-detail/document-detail.component.ts +++ b/src-ui/src/app/components/document-detail/document-detail.component.ts @@ -35,6 +35,13 @@ import { StoragePathService } from 'src/app/services/rest/storage-path.service' import { PaperlessStoragePath } from 'src/app/data/paperless-storage-path' import { StoragePathEditDialogComponent } from '../common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component' import { SETTINGS_KEYS } from 'src/app/data/paperless-uisettings' +import { + PermissionAction, + PermissionsService, + PermissionType, +} from 'src/app/services/permissions.service' +import { PaperlessUser } from 'src/app/data/paperless-user' +import { UserService } from 'src/app/services/rest/user.service' @Component({ selector: 'app-document-detail', @@ -58,6 +65,7 @@ export class DocumentDetailComponent document: PaperlessDocument metadata: PaperlessDocumentMetadata suggestions: PaperlessDocumentSuggestions + users: PaperlessUser[] title: string titleSubject: Subject = new Subject() @@ -78,6 +86,7 @@ export class DocumentDetailComponent storage_path: new FormControl(), archive_serial_number: new FormControl(), tags: new FormControl([]), + permissions_form: new FormControl(null), }) previewCurrentPage: number = 1 @@ -106,6 +115,9 @@ export class DocumentDetailComponent } } + PermissionAction = PermissionAction + PermissionType = PermissionType + constructor( private documentsService: DocumentService, private route: ActivatedRoute, @@ -118,7 +130,9 @@ export class DocumentDetailComponent private documentTitlePipe: DocumentTitlePipe, private toastService: ToastService, private settings: SettingsService, - private storagePathService: StoragePathService + private storagePathService: StoragePathService, + private permissionsService: PermissionsService, + private userService: UserService ) {} titleKeyUp(event) { @@ -147,7 +161,13 @@ export class DocumentDetailComponent .pipe(takeUntil(this.unsubscribeNotifier)) .subscribe(() => { this.error = null - Object.assign(this.document, this.documentForm.value) + const docValues = Object.assign({}, this.documentForm.value) + docValues['owner'] = + this.documentForm.get('permissions_form').value['owner'] + docValues['set_permissions'] = + this.documentForm.get('permissions_form').value['set_permissions'] + delete docValues['permissions_form'] + Object.assign(this.document, docValues) }) this.correspondentService @@ -165,6 +185,11 @@ export class DocumentDetailComponent .pipe(first()) .subscribe((result) => (this.storagePaths = result.results)) + this.userService + .listAll() + .pipe(first()) + .subscribe((result) => (this.users = result.results)) + this.route.paramMap .pipe( takeUntil(this.unsubscribeNotifier), @@ -232,6 +257,10 @@ export class DocumentDetailComponent storage_path: doc.storage_path, archive_serial_number: doc.archive_serial_number, tags: [...doc.tags], + permissions_form: { + owner: doc.owner, + set_permissions: doc.permissions, + }, }) this.isDirty$ = dirtyCheck( @@ -272,6 +301,9 @@ export class DocumentDetailComponent }, error: (error) => { this.metadata = null + this.toastService.showError( + $localize`Error retrieving metadata` + ': ' + error.toString() + ) }, }) this.documentsService @@ -283,10 +315,20 @@ export class DocumentDetailComponent }, error: (error) => { this.suggestions = null + this.toastService.showError( + $localize`Error retrieving suggestions` + ': ' + error.toString() + ) }, }) this.title = this.documentTitlePipe.transform(doc.title) - this.documentForm.patchValue(doc) + const docFormValues = Object.assign({}, doc) + docFormValues['permissions_form'] = { + owner: doc.owner, + set_permissions: doc.permissions, + } + + this.documentForm.patchValue(docFormValues, { emitEvent: false }) + if (!this.userCanEdit) this.documentForm.disable() } createDocumentType(newName: string) { @@ -378,7 +420,7 @@ export class DocumentDetailComponent .update(this.document) .pipe(first()) .subscribe({ - next: (result) => { + next: () => { this.close() this.networkActive = false this.error = null @@ -386,6 +428,11 @@ export class DocumentDetailComponent error: (error) => { this.networkActive = false this.error = error.error + this.toastService.showError( + $localize`Error saving document` + + ': ' + + (error.message ?? error.toString()) + ) }, }) } @@ -425,6 +472,11 @@ export class DocumentDetailComponent error: (error) => { this.networkActive = false this.error = error.error + this.toastService.showError( + $localize`Error saving document` + + ': ' + + (error.message ?? error.toString()) + ) }, }) } @@ -564,6 +616,36 @@ export class DocumentDetailComponent } get commentsEnabled(): boolean { - return this.settings.get(SETTINGS_KEYS.COMMENTS_ENABLED) + return ( + this.settings.get(SETTINGS_KEYS.COMMENTS_ENABLED) && + this.permissionsService.currentUserCan( + PermissionAction.View, + PermissionType.Document + ) + ) + } + + get userIsOwner(): boolean { + let doc: PaperlessDocument = Object.assign({}, this.document) + // dont disable while editing + if (this.document && this.store?.value.owner) { + doc.owner = this.store?.value.owner + } + return !this.document || this.permissionsService.currentUserOwnsObject(doc) + } + + get userCanEdit(): boolean { + let doc: PaperlessDocument = Object.assign({}, this.document) + // dont disable while editing + if (this.document && this.store?.value.owner) { + doc.owner = this.store?.value.owner + } + return ( + !this.document || + this.permissionsService.currentUserHasObjectPermissions( + PermissionAction.Change, + doc + ) + ) } } diff --git a/src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.html b/src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.html index aef47b605..e7bdc8d75 100644 --- a/src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.html +++ b/src-ui/src/app/components/document-list/bulk-editor/bulk-editor.component.html @@ -23,11 +23,12 @@
      -
      +
      -
      +
      + + +
      - +
      @@ -120,7 +131,7 @@
      -
      - + diff --git a/src-ui/src/app/components/document-list/document-card-small/document-card-small.component.ts b/src-ui/src/app/components/document-list/document-card-small/document-card-small.component.ts index b7f53e42c..0aa7bd758 100644 --- a/src-ui/src/app/components/document-list/document-card-small/document-card-small.component.ts +++ b/src-ui/src/app/components/document-list/document-card-small/document-card-small.component.ts @@ -11,6 +11,7 @@ import { DocumentService } from 'src/app/services/rest/document.service' import { SettingsService } from 'src/app/services/settings.service' import { NgbPopover } from '@ng-bootstrap/ng-bootstrap' import { SETTINGS_KEYS } from 'src/app/data/paperless-uisettings' +import { ComponentWithPermissions } from '../../with-permissions/with-permissions.component' @Component({ selector: 'app-document-card-small', @@ -20,11 +21,13 @@ import { SETTINGS_KEYS } from 'src/app/data/paperless-uisettings' '../popover-preview/popover-preview.scss', ], }) -export class DocumentCardSmallComponent { +export class DocumentCardSmallComponent extends ComponentWithPermissions { constructor( private documentService: DocumentService, private settingsService: SettingsService - ) {} + ) { + super() + } @Input() selected = false diff --git a/src-ui/src/app/components/document-list/document-list.component.html b/src-ui/src/app/components/document-list/document-list.component.html index 7f8502483..aa8685da9 100644 --- a/src-ui/src/app/components/document-list/document-list.component.html +++ b/src-ui/src/app/components/document-list/document-list.component.html @@ -59,7 +59,7 @@
      -
      +
      - +
      + +
      +
      diff --git a/src-ui/src/app/components/document-list/document-list.component.ts b/src-ui/src/app/components/document-list/document-list.component.ts index 3c1e6775f..d4a654444 100644 --- a/src-ui/src/app/components/document-list/document-list.component.ts +++ b/src-ui/src/app/components/document-list/document-list.component.ts @@ -30,6 +30,7 @@ import { } from 'src/app/services/rest/document.service' import { SavedViewService } from 'src/app/services/rest/saved-view.service' import { ToastService } from 'src/app/services/toast.service' +import { ComponentWithPermissions } from '../with-permissions/with-permissions.component' import { FilterEditorComponent } from './filter-editor/filter-editor.component' import { SaveViewConfigDialogComponent } from './save-view-config-dialog/save-view-config-dialog.component' @@ -38,7 +39,10 @@ import { SaveViewConfigDialogComponent } from './save-view-config-dialog/save-vi templateUrl: './document-list.component.html', styleUrls: ['./document-list.component.scss'], }) -export class DocumentListComponent implements OnInit, OnDestroy { +export class DocumentListComponent + extends ComponentWithPermissions + implements OnInit, OnDestroy +{ constructor( public list: DocumentListViewService, public savedViewService: SavedViewService, @@ -48,7 +52,9 @@ export class DocumentListComponent implements OnInit, OnDestroy { private modalService: NgbModal, private consumerStatusService: ConsumerStatusService, public openDocumentsService: OpenDocumentsService - ) {} + ) { + super() + } @ViewChild('filterEditor') private filterEditor: FilterEditorComponent diff --git a/src-ui/src/app/components/manage/correspondent-list/correspondent-list.component.ts b/src-ui/src/app/components/manage/correspondent-list/correspondent-list.component.ts index 983c36290..d40b2fe0f 100644 --- a/src-ui/src/app/components/manage/correspondent-list/correspondent-list.component.ts +++ b/src-ui/src/app/components/manage/correspondent-list/correspondent-list.component.ts @@ -4,6 +4,10 @@ import { FILTER_CORRESPONDENT } from 'src/app/data/filter-rule-type' import { PaperlessCorrespondent } from 'src/app/data/paperless-correspondent' import { CustomDatePipe } from 'src/app/pipes/custom-date.pipe' import { DocumentListViewService } from 'src/app/services/document-list-view.service' +import { + PermissionsService, + PermissionType, +} from 'src/app/services/permissions.service' import { CorrespondentService } from 'src/app/services/rest/correspondent.service' import { ToastService } from 'src/app/services/toast.service' import { CorrespondentEditDialogComponent } from '../../common/edit-dialog/correspondent-edit-dialog/correspondent-edit-dialog.component' @@ -21,6 +25,7 @@ export class CorrespondentListComponent extends ManagementListComponent - +
      @@ -41,24 +41,24 @@
      - - - + + +
      - - - +
      @@ -227,80 +235,84 @@ -
    • +
    • Mail -

      - Mail accounts - -

      -
        + +

        + Mail accounts + +

        +
          -
        • -
          -
          Name
          -
          Server
          -
          Actions
          -
          -
          • +
        • +
          +
          Name
          +
          Server
          +
          Actions
          +
          +
          • -
        • -
          -
          -
          {{account.imap_server}}
          -
          -
          - - +
        • +
          +
          +
          {{account.imap_server}}
          +
          +
          + + +
          -
      • - + -
      No mail accounts defined.
      - +
      No mail accounts defined.
      + + -

      - Mail rules - -

      -
        + +

        + Mail rules + +

        +
          -
        • -
          -
          Name
          -
          Account
          -
          Actions
          -
          -
          • +
        • +
          +
          Name
          +
          Account
          +
          Actions
          +
          +
          • -
        • -
          -
          -
          {{(mailAccountService.getCached(rule.account) | async)?.name}}
          -
          -
          - - +
        • +
          +
          +
          {{(mailAccountService.getCached(rule.account) | async)?.name}}
          +
          +
          + + +
          -
      - + -
      No mail rules defined.
      - +
      No mail rules defined.
      + +
      @@ -310,9 +322,95 @@ + +
    • + Users & Groups + + + +

      + Users + +

      +
        + +
      • +
        +
        Username
        +
        Name
        +
        Groups
        +
        Actions
        +
        +
        • + +
      • +
        +
        +
        {{user.first_name}} {{user.last_name}}
        +
        {{user.groups?.map(getGroupName, this).join(', ')}}
        +
        +
        + + +
        +
        +
        +
        • +
      + +

      + Groups + +

      +
        + +
      • +
        +
        Name
        +
        +
        +
        Actions
        +
        +
        • + +
      • +
        +
        +
        +
        +
        +
        + + +
        +
        +
        +
        • +
      + +
      No groups defined
      +       + +
      + + +
      + +       +
      • - + diff --git a/src-ui/src/app/components/manage/settings/settings.component.ts b/src-ui/src/app/components/manage/settings/settings.component.ts index 21b066fbb..ee26073f8 100644 --- a/src-ui/src/app/components/manage/settings/settings.component.ts +++ b/src-ui/src/app/components/manage/settings/settings.component.ts @@ -29,15 +29,21 @@ import { SETTINGS_KEYS } from 'src/app/data/paperless-uisettings' import { ActivatedRoute, Router } from '@angular/router' import { ViewportScroller } from '@angular/common' import { TourService } from 'ngx-ui-tour-ng-bootstrap' +import { ComponentWithPermissions } from '../../with-permissions/with-permissions.component' +import { NgbModal, NgbNavChangeEvent } from '@ng-bootstrap/ng-bootstrap' +import { UserService } from 'src/app/services/rest/user.service' +import { GroupService } from 'src/app/services/rest/group.service' +import { PaperlessUser } from 'src/app/data/paperless-user' +import { PaperlessGroup } from 'src/app/data/paperless-group' +import { UserEditDialogComponent } from '../../common/edit-dialog/user-edit-dialog/user-edit-dialog.component' +import { ConfirmDialogComponent } from '../../common/confirm-dialog/confirm-dialog.component' +import { GroupEditDialogComponent } from '../../common/edit-dialog/group-edit-dialog/group-edit-dialog.component' import { PaperlessMailAccount } from 'src/app/data/paperless-mail-account' import { PaperlessMailRule } from 'src/app/data/paperless-mail-rule' import { MailAccountService } from 'src/app/services/rest/mail-account.service' import { MailRuleService } from 'src/app/services/rest/mail-rule.service' -import { NgbModal } from '@ng-bootstrap/ng-bootstrap' import { MailAccountEditDialogComponent } from '../../common/edit-dialog/mail-account-edit-dialog/mail-account-edit-dialog.component' import { MailRuleEditDialogComponent } from '../../common/edit-dialog/mail-rule-edit-dialog/mail-rule-edit-dialog.component' -import { ConfirmDialogComponent } from '../../common/confirm-dialog/confirm-dialog.component' -import { NgbNavChangeEvent } from '@ng-bootstrap/ng-bootstrap' enum SettingsNavIDs { General = 1, @@ -53,12 +59,15 @@ enum SettingsNavIDs { styleUrls: ['./settings.component.scss'], }) export class SettingsComponent + extends ComponentWithPermissions implements OnInit, AfterViewInit, OnDestroy, DirtyComponent { SettingsNavIDs = SettingsNavIDs activeNavID: number savedViewGroup = new FormGroup({}) + usersGroup = new FormGroup({}) + groupsGroup = new FormGroup({}) mailAccountGroup = new FormGroup({}) mailRuleGroup = new FormGroup({}) @@ -83,7 +92,10 @@ export class SettingsComponent notificationsConsumerSuccess: new FormControl(null), notificationsConsumerFailed: new FormControl(null), notificationsConsumerSuppressOnDashboard: new FormControl(null), + usersGroup: this.usersGroup, + groupsGroup: this.groupsGroup, + savedViewsWarnOnUnsavedChange: new FormControl(null), savedViews: this.savedViewGroup, mailAccounts: this.mailAccountGroup, @@ -102,6 +114,9 @@ export class SettingsComponent unsubscribeNotifier: Subject = new Subject() savePending: boolean = false + users: PaperlessUser[] + groups: PaperlessGroup[] + get computedDateLocale(): string { return ( this.settingsForm.value.dateLocale || @@ -120,10 +135,13 @@ export class SettingsComponent @Inject(LOCALE_ID) public currentLocale: string, private viewportScroller: ViewportScroller, private activatedRoute: ActivatedRoute, - private router: Router, public readonly tourService: TourService, + private usersService: UserService, + private groupsService: GroupService, + private router: Router, private modalService: NgbModal ) { + super() this.settings.settingsSaved.subscribe(() => { if (!this.savePending) this.initialize() }) @@ -194,6 +212,11 @@ export class SettingsComponent notificationsConsumerSuppressOnDashboard: this.settings.get( SETTINGS_KEYS.NOTIFICATIONS_CONSUMER_SUPPRESS_ON_DASHBOARD ), + savedViewsWarnOnUnsavedChange: this.settings.get( + SETTINGS_KEYS.SAVED_VIEWS_WARN_ON_UNSAVED_CHANGE + ), + usersGroup: {}, + groupsGroup: {}, savedViews: {}, mailAccounts: {}, mailRules: {}, @@ -225,6 +248,17 @@ export class SettingsComponent this.savedViews = r.results this.initialize(false) }) + } else if ( + navID == SettingsNavIDs.UsersGroups && + (!this.users || !this.groups) + ) { + this.usersService.listAll().subscribe((r) => { + this.users = r.results + this.groupsService.listAll().subscribe((r) => { + this.groups = r.results + this.initialize(false) + }) + }) } else if ( navID == SettingsNavIDs.Mail && (!this.mailAccounts || !this.mailRules) @@ -267,6 +301,50 @@ export class SettingsComponent } } + if (this.users && this.groups) { + for (let user of this.users) { + storeData.usersGroup[user.id.toString()] = { + id: user.id, + username: user.username, + first_name: user.first_name, + last_name: user.last_name, + is_active: user.is_active, + is_superuser: user.is_superuser, + groups: user.groups, + user_permissions: user.user_permissions, + } + this.usersGroup.addControl( + user.id.toString(), + new FormGroup({ + id: new FormControl(null), + username: new FormControl(null), + first_name: new FormControl(null), + last_name: new FormControl(null), + is_active: new FormControl(null), + is_superuser: new FormControl(null), + groups: new FormControl(null), + user_permissions: new FormControl(null), + }) + ) + } + + for (let group of this.groups) { + storeData.groupsGroup[group.id.toString()] = { + id: group.id, + name: group.name, + permissions: group.permissions, + } + this.groupsGroup.addControl( + group.id.toString(), + new FormGroup({ + id: new FormControl(null), + name: new FormControl(null), + permissions: new FormControl(null), + }) + ) + } + } + if (this.mailAccounts && this.mailRules) { for (let account of this.mailAccounts) { storeData.mailAccounts[account.id.toString()] = { @@ -462,6 +540,10 @@ export class SettingsComponent SETTINGS_KEYS.UPDATE_CHECKING_ENABLED, this.settingsForm.value.updateCheckingEnabled ) + this.settings.set( + SETTINGS_KEYS.SAVED_VIEWS_WARN_ON_UNSAVED_CHANGE, + this.settingsForm.value.savedViewsWarnOnUnsavedChange + ) this.settings.setLanguage(this.settingsForm.value.displayLanguage) this.settings .storeSettings() @@ -539,6 +621,120 @@ export class SettingsComponent this.settingsForm.get('themeColor').patchValue('') } + editUser(user: PaperlessUser) { + var modal = this.modalService.open(UserEditDialogComponent, { + backdrop: 'static', + size: 'xl', + }) + modal.componentInstance.dialogMode = user ? 'edit' : 'create' + modal.componentInstance.object = user + modal.componentInstance.succeeded + .pipe(takeUntil(this.unsubscribeNotifier)) + .subscribe({ + next: (newUser) => { + this.toastService.showInfo( + $localize`Saved user "${newUser.username}".` + ) + this.usersService.listAll().subscribe((r) => { + this.users = r.results + this.initialize() + }) + }, + error: (e) => { + this.toastService.showError( + $localize`Error saving user: ${e.toString()}.` + ) + }, + }) + } + + deleteUser(user: PaperlessUser) { + let modal = this.modalService.open(ConfirmDialogComponent, { + backdrop: 'static', + }) + modal.componentInstance.title = $localize`Confirm delete user account` + modal.componentInstance.messageBold = $localize`This operation will permanently this user account.` + modal.componentInstance.message = $localize`This operation cannot be undone.` + modal.componentInstance.btnClass = 'btn-danger' + modal.componentInstance.btnCaption = $localize`Proceed` + modal.componentInstance.confirmClicked.subscribe(() => { + modal.componentInstance.buttonsEnabled = false + this.usersService.delete(user).subscribe({ + next: () => { + modal.close() + this.toastService.showInfo($localize`Deleted user`) + this.usersService.listAll().subscribe((r) => { + this.users = r.results + this.initialize() + }) + }, + error: (e) => { + this.toastService.showError( + $localize`Error deleting user: ${e.toString()}.` + ) + }, + }) + }) + } + + editGroup(group: PaperlessGroup) { + var modal = this.modalService.open(GroupEditDialogComponent, { + backdrop: 'static', + size: 'lg', + }) + modal.componentInstance.dialogMode = group ? 'edit' : 'create' + modal.componentInstance.object = group + modal.componentInstance.succeeded + .pipe(takeUntil(this.unsubscribeNotifier)) + .subscribe({ + next: (newGroup) => { + this.toastService.showInfo($localize`Saved group "${newGroup.name}".`) + this.groupsService.listAll().subscribe((r) => { + this.groups = r.results + this.initialize() + }) + }, + error: (e) => { + this.toastService.showError( + $localize`Error saving group: ${e.toString()}.` + ) + }, + }) + } + + deleteGroup(group: PaperlessGroup) { + let modal = this.modalService.open(ConfirmDialogComponent, { + backdrop: 'static', + }) + modal.componentInstance.title = $localize`Confirm delete user group` + modal.componentInstance.messageBold = $localize`This operation will permanently this user group.` + modal.componentInstance.message = $localize`This operation cannot be undone.` + modal.componentInstance.btnClass = 'btn-danger' + modal.componentInstance.btnCaption = $localize`Proceed` + modal.componentInstance.confirmClicked.subscribe(() => { + modal.componentInstance.buttonsEnabled = false + this.groupsService.delete(group).subscribe({ + next: () => { + modal.close() + this.toastService.showInfo($localize`Deleted group`) + this.groupsService.listAll().subscribe((r) => { + this.groups = r.results + this.initialize() + }) + }, + error: (e) => { + this.toastService.showError( + $localize`Error deleting group: ${e.toString()}.` + ) + }, + }) + }) + } + + getGroupName(id: number): string { + return this.groups?.find((g) => g.id === id)?.name ?? '' + } + editMailAccount(account: PaperlessMailAccount) { const modal = this.modalService.open(MailAccountEditDialogComponent, { backdrop: 'static', diff --git a/src-ui/src/app/components/manage/storage-path-list/storage-path-list.component.ts b/src-ui/src/app/components/manage/storage-path-list/storage-path-list.component.ts index 1d7b726a0..d7c0ec21a 100644 --- a/src-ui/src/app/components/manage/storage-path-list/storage-path-list.component.ts +++ b/src-ui/src/app/components/manage/storage-path-list/storage-path-list.component.ts @@ -3,6 +3,10 @@ import { NgbModal } from '@ng-bootstrap/ng-bootstrap' import { FILTER_STORAGE_PATH } from 'src/app/data/filter-rule-type' import { PaperlessStoragePath } from 'src/app/data/paperless-storage-path' import { DocumentListViewService } from 'src/app/services/document-list-view.service' +import { + PermissionsService, + PermissionType, +} from 'src/app/services/permissions.service' import { StoragePathService } from 'src/app/services/rest/storage-path.service' import { ToastService } from 'src/app/services/toast.service' import { StoragePathEditDialogComponent } from '../../common/edit-dialog/storage-path-edit-dialog/storage-path-edit-dialog.component' @@ -18,7 +22,8 @@ export class StoragePathListComponent extends ManagementListComponent { tagService: TagService, modalService: NgbModal, toastService: ToastService, - documentListViewService: DocumentListViewService + documentListViewService: DocumentListViewService, + permissionsService: PermissionsService ) { super( tagService, @@ -26,9 +31,11 @@ export class TagListComponent extends ManagementListComponent { TagEditDialogComponent, toastService, documentListViewService, + permissionsService, FILTER_HAS_TAGS_ALL, $localize`tag`, $localize`tags`, + PermissionType.Tag, [ { key: 'color', diff --git a/src-ui/src/app/components/manage/tasks/tasks.component.html b/src-ui/src/app/components/manage/tasks/tasks.component.html index f6b09333d..4ffc5e672 100644 --- a/src-ui/src/app/components/manage/tasks/tasks.component.html +++ b/src-ui/src/app/components/manage/tasks/tasks.component.html @@ -5,7 +5,7 @@  Clear selection -
      diff --git a/src-ui/src/app/components/manage/tasks/tasks.component.ts b/src-ui/src/app/components/manage/tasks/tasks.component.ts index a2601dd8b..ab6d3015e 100644 --- a/src-ui/src/app/components/manage/tasks/tasks.component.ts +++ b/src-ui/src/app/components/manage/tasks/tasks.component.ts @@ -5,13 +5,17 @@ import { Subject, first } from 'rxjs' import { PaperlessTask } from 'src/app/data/paperless-task' import { TasksService } from 'src/app/services/tasks.service' import { ConfirmDialogComponent } from '../../common/confirm-dialog/confirm-dialog.component' +import { ComponentWithPermissions } from '../../with-permissions/with-permissions.component' @Component({ selector: 'app-tasks', templateUrl: './tasks.component.html', styleUrls: ['./tasks.component.scss'], }) -export class TasksComponent implements OnInit, OnDestroy { +export class TasksComponent + extends ComponentWithPermissions + implements OnInit, OnDestroy +{ public activeTab: string public selectedTasks: Set = new Set() private unsubscribeNotifer = new Subject() @@ -27,7 +31,9 @@ export class TasksComponent implements OnInit, OnDestroy { public tasksService: TasksService, private modalService: NgbModal, private readonly router: Router - ) {} + ) { + super() + } ngOnInit() { this.tasksService.reload() diff --git a/src-ui/src/app/components/with-permissions/with-permissions.component.ts b/src-ui/src/app/components/with-permissions/with-permissions.component.ts new file mode 100644 index 000000000..db8071a8e --- /dev/null +++ b/src-ui/src/app/components/with-permissions/with-permissions.component.ts @@ -0,0 +1,9 @@ +import { + PermissionAction, + PermissionType, +} from 'src/app/services/permissions.service' + +export class ComponentWithPermissions { + public readonly PermissionAction = PermissionAction + public readonly PermissionType = PermissionType +} diff --git a/src-ui/src/app/data/matching-model.ts b/src-ui/src/app/data/matching-model.ts index 8ce05528e..387625b54 100644 --- a/src-ui/src/app/data/matching-model.ts +++ b/src-ui/src/app/data/matching-model.ts @@ -1,4 +1,4 @@ -import { ObjectWithId } from './object-with-id' +import { ObjectWithPermissions } from './object-with-permissions' export const MATCH_ANY = 1 export const MATCH_ALL = 2 @@ -41,7 +41,7 @@ export const MATCHING_ALGORITHMS = [ }, ] -export interface MatchingModel extends ObjectWithId { +export interface MatchingModel extends ObjectWithPermissions { name?: string slug?: string diff --git a/src-ui/src/app/data/object-with-permissions.ts b/src-ui/src/app/data/object-with-permissions.ts new file mode 100644 index 000000000..86f5f7394 --- /dev/null +++ b/src-ui/src/app/data/object-with-permissions.ts @@ -0,0 +1,19 @@ +import { ObjectWithId } from './object-with-id' +import { PaperlessUser } from './paperless-user' + +export interface PermissionsObject { + view: { + users: Array + groups: Array + } + change: { + users: Array + groups: Array + } +} + +export interface ObjectWithPermissions extends ObjectWithId { + owner?: number + + permissions?: PermissionsObject +} diff --git a/src-ui/src/app/data/paperless-document-comment.ts b/src-ui/src/app/data/paperless-document-comment.ts index 14085cf32..884e59096 100644 --- a/src-ui/src/app/data/paperless-document-comment.ts +++ b/src-ui/src/app/data/paperless-document-comment.ts @@ -1,8 +1,8 @@ import { ObjectWithId } from './object-with-id' -import { User } from './user' +import { PaperlessUser } from './paperless-user' export interface PaperlessDocumentComment extends ObjectWithId { created?: Date comment?: string - user?: User + user?: PaperlessUser } diff --git a/src-ui/src/app/data/paperless-document.ts b/src-ui/src/app/data/paperless-document.ts index cdee624af..8936e2b43 100644 --- a/src-ui/src/app/data/paperless-document.ts +++ b/src-ui/src/app/data/paperless-document.ts @@ -1,9 +1,9 @@ import { PaperlessCorrespondent } from './paperless-correspondent' -import { ObjectWithId } from './object-with-id' import { PaperlessTag } from './paperless-tag' import { PaperlessDocumentType } from './paperless-document-type' import { Observable } from 'rxjs' import { PaperlessStoragePath } from './paperless-storage-path' +import { ObjectWithPermissions } from './object-with-permissions' export interface SearchHit { score?: number @@ -13,7 +13,7 @@ export interface SearchHit { comment_highlights?: string } -export interface PaperlessDocument extends ObjectWithId { +export interface PaperlessDocument extends ObjectWithPermissions { correspondent$?: Observable correspondent?: number diff --git a/src-ui/src/app/data/paperless-group.ts b/src-ui/src/app/data/paperless-group.ts new file mode 100644 index 000000000..b78efeb5a --- /dev/null +++ b/src-ui/src/app/data/paperless-group.ts @@ -0,0 +1,9 @@ +import { ObjectWithId } from './object-with-id' + +export interface PaperlessGroup extends ObjectWithId { + name?: string + + user_count?: number // not implemented yet + + permissions?: string[] +} diff --git a/src-ui/src/app/data/paperless-uisettings.ts b/src-ui/src/app/data/paperless-uisettings.ts index 403d11f08..5f89708b5 100644 --- a/src-ui/src/app/data/paperless-uisettings.ts +++ b/src-ui/src/app/data/paperless-uisettings.ts @@ -1,11 +1,8 @@ export interface PaperlessUiSettings { user_id: number - username: string - - display_name: string - settings: Object + permissions: string[] } export interface PaperlessUiSetting { @@ -41,6 +38,8 @@ export const SETTINGS_KEYS = { UPDATE_CHECKING_ENABLED: 'general-settings:update-checking:enabled', UPDATE_CHECKING_BACKEND_SETTING: 'general-settings:update-checking:backend-setting', + SAVED_VIEWS_WARN_ON_UNSAVED_CHANGE: + 'general-settings:saved-views:warn-on-unsaved-change', } export const SETTINGS: PaperlessUiSetting[] = [ @@ -139,4 +138,9 @@ export const SETTINGS: PaperlessUiSetting[] = [ type: 'string', default: '', }, + { + key: SETTINGS_KEYS.SAVED_VIEWS_WARN_ON_UNSAVED_CHANGE, + type: 'boolean', + default: true, + }, ] diff --git a/src-ui/src/app/data/paperless-user.ts b/src-ui/src/app/data/paperless-user.ts new file mode 100644 index 000000000..125a2f509 --- /dev/null +++ b/src-ui/src/app/data/paperless-user.ts @@ -0,0 +1,15 @@ +import { PaperlessGroup } from 'src/app/data/paperless-group' +import { ObjectWithId } from './object-with-id' + +export interface PaperlessUser extends ObjectWithId { + username?: string + first_name?: string + last_name?: string + date_joined?: Date + is_staff?: boolean + is_active?: boolean + is_superuser?: boolean + groups?: PaperlessGroup[] + user_permissions?: string[] + inherited_permissions?: string[] +} diff --git a/src-ui/src/app/data/user.ts b/src-ui/src/app/data/user.ts deleted file mode 100644 index adf00e86b..000000000 --- a/src-ui/src/app/data/user.ts +++ /dev/null @@ -1,7 +0,0 @@ -import { ObjectWithId } from './object-with-id' - -export interface User extends ObjectWithId { - username: string - firstname: string - lastname: string -} diff --git a/src-ui/src/app/directives/if-object-permissions.directive.ts b/src-ui/src/app/directives/if-object-permissions.directive.ts new file mode 100644 index 000000000..3f4f565e9 --- /dev/null +++ b/src-ui/src/app/directives/if-object-permissions.directive.ts @@ -0,0 +1,60 @@ +import { + Directive, + EmbeddedViewRef, + Input, + OnChanges, + OnInit, + TemplateRef, + ViewContainerRef, +} from '@angular/core' +import { ObjectWithPermissions } from '../data/object-with-permissions' +import { + PermissionAction, + PermissionsService, +} from '../services/permissions.service' + +@Directive({ + selector: '[appIfObjectPermissions]', +}) +export class IfObjectPermissionsDirective implements OnInit, OnChanges { + // The role the user must have + @Input() + appIfObjectPermissions: { + object: ObjectWithPermissions + action: PermissionAction + } + + createdView: EmbeddedViewRef + + /** + * @param {ViewContainerRef} viewContainerRef -- The location where we need to render the templateRef + * @param {TemplateRef} templateRef -- The templateRef to be potentially rendered + * @param {PermissionsService} permissionsService -- Will give us access to the permissions a user has + */ + constructor( + private viewContainerRef: ViewContainerRef, + private templateRef: TemplateRef, + private permissionsService: PermissionsService + ) {} + + public ngOnInit(): void { + if ( + !this.appIfObjectPermissions?.object || + this.permissionsService.currentUserHasObjectPermissions( + this.appIfObjectPermissions.action, + this.appIfObjectPermissions.object + ) + ) { + if (!this.createdView) + this.createdView = this.viewContainerRef.createEmbeddedView( + this.templateRef + ) + } else { + this.viewContainerRef.clear() + } + } + + public ngOnChanges(): void { + this.ngOnInit() + } +} diff --git a/src-ui/src/app/directives/if-owner.directive.ts b/src-ui/src/app/directives/if-owner.directive.ts new file mode 100644 index 000000000..7b2efa927 --- /dev/null +++ b/src-ui/src/app/directives/if-owner.directive.ts @@ -0,0 +1,48 @@ +import { + Directive, + EmbeddedViewRef, + Input, + OnChanges, + OnInit, + TemplateRef, + ViewContainerRef, +} from '@angular/core' +import { ObjectWithPermissions } from '../data/object-with-permissions' +import { PermissionsService } from '../services/permissions.service' + +@Directive({ + selector: '[appIfOwner]', +}) +export class IfOwnerDirective implements OnInit, OnChanges { + // The role the user must have + @Input() + appIfOwner: ObjectWithPermissions + + createdView: EmbeddedViewRef + + /** + * @param {ViewContainerRef} viewContainerRef -- The location where we need to render the templateRef + * @param {TemplateRef} templateRef -- The templateRef to be potentially rendered + * @param {PermissionsService} permissionsService -- Will give us access to the permissions a user has + */ + constructor( + private viewContainerRef: ViewContainerRef, + private templateRef: TemplateRef, + private permissionsService: PermissionsService + ) {} + + public ngOnInit(): void { + if (this.permissionsService.currentUserOwnsObject(this.appIfOwner)) { + if (!this.createdView) + this.createdView = this.viewContainerRef.createEmbeddedView( + this.templateRef + ) + } else { + this.viewContainerRef.clear() + } + } + + public ngOnChanges(): void { + this.ngOnInit() + } +} diff --git a/src-ui/src/app/directives/if-permissions.directive.ts b/src-ui/src/app/directives/if-permissions.directive.ts new file mode 100644 index 000000000..9251185e2 --- /dev/null +++ b/src-ui/src/app/directives/if-permissions.directive.ts @@ -0,0 +1,47 @@ +import { + Input, + OnInit, + Directive, + ViewContainerRef, + TemplateRef, +} from '@angular/core' +import { + PermissionAction, + PermissionsService, + PermissionType, +} from '../services/permissions.service' + +@Directive({ + selector: '[appIfPermissions]', +}) +export class IfPermissionsDirective implements OnInit { + @Input() + appIfPermissions: + | Array<{ action: PermissionAction; type: PermissionType }> + | { action: PermissionAction; type: PermissionType } + + /** + * @param {ViewContainerRef} viewContainerRef -- The location where we need to render the templateRef + * @param {TemplateRef} templateRef -- The templateRef to be potentially rendered + * @param {PermissionsService} permissionsService -- Will give us access to the permissions a user has + */ + constructor( + private viewContainerRef: ViewContainerRef, + private templateRef: TemplateRef, + private permissionsService: PermissionsService + ) {} + + public ngOnInit(): void { + if ( + [] + .concat(this.appIfPermissions) + .every((perm: { action: PermissionAction; type: PermissionType }) => + this.permissionsService.currentUserCan(perm.action, perm.type) + ) + ) { + this.viewContainerRef.createEmbeddedView(this.templateRef) + } else { + this.viewContainerRef.clear() + } + } +} diff --git a/src-ui/src/app/directives/sortable.directive.spec.ts b/src-ui/src/app/directives/sortable.directive.spec.ts deleted file mode 100644 index 03f6d8c71..000000000 --- a/src-ui/src/app/directives/sortable.directive.spec.ts +++ /dev/null @@ -1,8 +0,0 @@ -import { SortableDirective } from './sortable.directive' - -describe('SortableDirective', () => { - it('should create an instance', () => { - const directive = new SortableDirective() - expect(directive).toBeTruthy() - }) -}) diff --git a/src-ui/src/app/guards/dirty-saved-view.guard.ts b/src-ui/src/app/guards/dirty-saved-view.guard.ts index 0044a2e78..d33976eb1 100644 --- a/src-ui/src/app/guards/dirty-saved-view.guard.ts +++ b/src-ui/src/app/guards/dirty-saved-view.guard.ts @@ -4,17 +4,25 @@ import { first, Observable, Subject } from 'rxjs' import { DocumentListComponent } from '../components/document-list/document-list.component' import { NgbModal } from '@ng-bootstrap/ng-bootstrap' import { ConfirmDialogComponent } from '../components/common/confirm-dialog/confirm-dialog.component' +import { SettingsService } from '../services/settings.service' +import { SETTINGS_KEYS } from '../data/paperless-uisettings' @Injectable() export class DirtySavedViewGuard implements CanDeactivate { - constructor(private modalService: NgbModal) {} + constructor( + private modalService: NgbModal, + private settings: SettingsService + ) {} canDeactivate( component: DocumentListComponent ): boolean | Observable { - return component.savedViewIsModified ? this.warn(component) : true + return component.savedViewIsModified && + this.settings.get(SETTINGS_KEYS.SAVED_VIEWS_WARN_ON_UNSAVED_CHANGE) + ? this.warn(component) + : true } warn(component: DocumentListComponent) { diff --git a/src-ui/src/app/guards/permissions.guard.ts b/src-ui/src/app/guards/permissions.guard.ts new file mode 100644 index 000000000..916408fe2 --- /dev/null +++ b/src-ui/src/app/guards/permissions.guard.ts @@ -0,0 +1,38 @@ +import { + CanActivate, + ActivatedRouteSnapshot, + RouterStateSnapshot, + UrlTree, + Router, +} from '@angular/router' +import { Injectable } from '@angular/core' +import { PermissionsService } from '../services/permissions.service' +import { ToastService } from '../services/toast.service' + +@Injectable() +export class PermissionsGuard implements CanActivate { + constructor( + private permissionsService: PermissionsService, + private router: Router, + private toastService: ToastService + ) {} + + canActivate( + route: ActivatedRouteSnapshot, + state: RouterStateSnapshot + ): boolean | UrlTree { + if ( + !this.permissionsService.currentUserCan( + route.data.requiredPermission.action, + route.data.requiredPermission.type + ) + ) { + this.toastService.showError( + $localize`You don't have permissions to do that` + ) + return this.router.parseUrl('/dashboard') + } else { + return true + } + } +} diff --git a/src-ui/src/app/services/permissions.service.ts b/src-ui/src/app/services/permissions.service.ts new file mode 100644 index 000000000..bca2037fa --- /dev/null +++ b/src-ui/src/app/services/permissions.service.ts @@ -0,0 +1,96 @@ +import { Injectable } from '@angular/core' +import { ObjectWithPermissions } from '../data/object-with-permissions' +import { PaperlessUser } from '../data/paperless-user' + +export enum PermissionAction { + Add = 'add', + View = 'view', + Change = 'change', + Delete = 'delete', +} + +export enum PermissionType { + Document = '%s_document', + Tag = '%s_tag', + Correspondent = '%s_correspondent', + DocumentType = '%s_documenttype', + StoragePath = '%s_storagepath', + SavedView = '%s_savedview', + PaperlessTask = '%s_paperlesstask', + UISettings = '%s_uisettings', + Comment = '%s_comment', + MailAccount = '%s_mailaccount', + MailRule = '%s_mailrule', + User = '%s_user', + Group = '%s_group', + Admin = '%s_logentry', +} + +@Injectable({ + providedIn: 'root', +}) +export class PermissionsService { + private permissions: string[] + private currentUser: PaperlessUser + + public initialize(permissions: string[], currentUser: PaperlessUser) { + this.permissions = permissions + this.currentUser = currentUser + } + + public currentUserCan( + action: PermissionAction, + type: PermissionType + ): boolean { + return this.permissions.includes(this.getPermissionCode(action, type)) + } + + public currentUserOwnsObject(object: ObjectWithPermissions): boolean { + return !object || !object.owner || object.owner === this.currentUser.id + } + + public currentUserHasObjectPermissions( + action: string, + object: ObjectWithPermissions + ): boolean { + return ( + this.currentUserOwnsObject(object) || + (object.permissions[action]['users'] as Array)?.includes( + this.currentUser.id + ) + ) + } + + public getPermissionCode( + action: PermissionAction, + type: PermissionType + ): string { + return type.replace('%s', action) + } + + public getPermissionKeys(permissionStr: string): { + actionKey: string + typeKey: string + } { + const matches = permissionStr.match(/(.+)_/) + let typeKey + let actionKey + if (matches?.length > 0) { + const action = matches[1] + const actionIndex = Object.values(PermissionAction).indexOf( + action as PermissionAction + ) + if (actionIndex > -1) { + actionKey = Object.keys(PermissionAction)[actionIndex] + } + const typeIndex = Object.values(PermissionType).indexOf( + permissionStr.replace(action, '%s') as PermissionType + ) + if (typeIndex > -1) { + typeKey = Object.keys(PermissionType)[typeIndex] + } + } + + return { actionKey, typeKey } + } +} diff --git a/src-ui/src/app/services/rest/abstract-paperless-service.ts b/src-ui/src/app/services/rest/abstract-paperless-service.ts index 9a5664c9d..f7833c812 100644 --- a/src-ui/src/app/services/rest/abstract-paperless-service.ts +++ b/src-ui/src/app/services/rest/abstract-paperless-service.ts @@ -2,8 +2,10 @@ import { HttpClient, HttpParams } from '@angular/common/http' import { Observable } from 'rxjs' import { map, publishReplay, refCount } from 'rxjs/operators' import { ObjectWithId } from 'src/app/data/object-with-id' +import { PaperlessUser } from 'src/app/data/paperless-user' import { Results } from 'src/app/data/results' import { environment } from 'src/environments/environment' +import { PermissionAction, PermissionType } from '../permissions.service' export abstract class AbstractPaperlessService { protected baseUrl: string = environment.apiBaseUrl diff --git a/src-ui/src/app/services/rest/group.service.ts b/src-ui/src/app/services/rest/group.service.ts new file mode 100644 index 000000000..800c3c71b --- /dev/null +++ b/src-ui/src/app/services/rest/group.service.ts @@ -0,0 +1,31 @@ +import { HttpClient } from '@angular/common/http' +import { Injectable } from '@angular/core' +import { Observable, switchMap } from 'rxjs' +import { PaperlessGroup } from 'src/app/data/paperless-group' +import { PermissionsService } from '../permissions.service' +import { AbstractNameFilterService } from './abstract-name-filter-service' + +@Injectable({ + providedIn: 'root', +}) +export class GroupService extends AbstractNameFilterService { + constructor(http: HttpClient, private permissionService: PermissionsService) { + super(http, 'groups') + } + + update(o: PaperlessGroup): Observable { + return this.getCached(o.id).pipe( + switchMap((initialGroup) => { + initialGroup.permissions?.forEach((perm) => { + const { typeKey, actionKey } = + this.permissionService.getPermissionKeys(perm) + if (!typeKey || !actionKey) { + // dont lose permissions the UI doesnt use + o.permissions.push(perm) + } + }) + return super.update(o) + }) + ) + } +} diff --git a/src-ui/src/app/services/rest/user.service.ts b/src-ui/src/app/services/rest/user.service.ts new file mode 100644 index 000000000..125a35ce6 --- /dev/null +++ b/src-ui/src/app/services/rest/user.service.ts @@ -0,0 +1,31 @@ +import { HttpClient } from '@angular/common/http' +import { Injectable } from '@angular/core' +import { Observable, switchMap } from 'rxjs' +import { PaperlessUser } from 'src/app/data/paperless-user' +import { PermissionsService } from '../permissions.service' +import { AbstractNameFilterService } from './abstract-name-filter-service' + +@Injectable({ + providedIn: 'root', +}) +export class UserService extends AbstractNameFilterService { + constructor(http: HttpClient, private permissionService: PermissionsService) { + super(http, 'users') + } + + update(o: PaperlessUser): Observable { + return this.getCached(o.id).pipe( + switchMap((initialUser) => { + initialUser.user_permissions?.forEach((perm) => { + const { typeKey, actionKey } = + this.permissionService.getPermissionKeys(perm) + if (!typeKey || !actionKey) { + // dont lose permissions the UI doesnt use + o.user_permissions.push(perm) + } + }) + return super.update(o) + }) + ) + } +} diff --git a/src-ui/src/app/services/settings.service.ts b/src-ui/src/app/services/settings.service.ts index d111acd76..5d8eb733f 100644 --- a/src-ui/src/app/services/settings.service.ts +++ b/src-ui/src/app/services/settings.service.ts @@ -23,6 +23,8 @@ import { SETTINGS, SETTINGS_KEYS, } from '../data/paperless-uisettings' +import { PaperlessUser } from '../data/paperless-user' +import { PermissionsService } from './permissions.service' import { SavedViewService } from './rest/saved-view.service' import { ToastService } from './toast.service' @@ -45,8 +47,7 @@ export class SettingsService { protected baseUrl: string = environment.apiBaseUrl + 'ui_settings/' private settings: Object = {} - - public displayName: string + currentUser: PaperlessUser public settingsSaved: EventEmitter = new EventEmitter() @@ -58,7 +59,8 @@ export class SettingsService { @Inject(LOCALE_ID) private localeId: string, protected http: HttpClient, private toastService: ToastService, - private savedViewService: SavedViewService + private savedViewService: SavedViewService, + private permissionsService: PermissionsService ) { this.renderer = rendererFactory.createRenderer(null, null) } @@ -73,11 +75,26 @@ export class SettingsService { // to update lang cookie if (this.settings['language']?.length) this.setLanguage(this.settings['language']) - this.displayName = uisettings.display_name.trim() + this.currentUser = { + id: uisettings['user_id'], + username: uisettings['username'], + } + this.permissionsService.initialize( + uisettings.permissions, + this.currentUser + ) }) ) } + get displayName(): string { + return ( + this.currentUser.first_name ?? + this.currentUser.username ?? + '' + ).trim() + } + public updateAppearanceSettings( darkModeUseSystem = null, darkModeEnabled = null, diff --git a/src-ui/src/app/services/toast.service.ts b/src-ui/src/app/services/toast.service.ts index 7c35b624c..6bd1158bc 100644 --- a/src-ui/src/app/services/toast.service.ts +++ b/src-ui/src/app/services/toast.service.ts @@ -11,6 +11,8 @@ export interface Toast { action?: any actionName?: string + + classname?: string } @Injectable({ @@ -29,7 +31,12 @@ export class ToastService { } showError(content: string, delay: number = 10000) { - this.show({ title: $localize`Error`, content: content, delay: delay }) + this.show({ + title: $localize`Error`, + content: content, + delay: delay, + classname: 'error', + }) } showInfo(content: string, delay: number = 5000) { diff --git a/src-ui/src/app/services/upload-documents.service.ts b/src-ui/src/app/services/upload-documents.service.ts index 5e7ef7fbe..3ec93ecf6 100644 --- a/src-ui/src/app/services/upload-documents.service.ts +++ b/src-ui/src/app/services/upload-documents.service.ts @@ -7,6 +7,7 @@ import { } from './consumer-status.service' import { DocumentService } from './rest/document.service' import { Subscription } from 'rxjs' +import { SettingsService } from './settings.service' @Injectable({ providedIn: 'root', @@ -16,7 +17,8 @@ export class UploadDocumentsService { constructor( private documentService: DocumentService, - private consumerStatusService: ConsumerStatusService + private consumerStatusService: ConsumerStatusService, + private settings: SettingsService ) {} uploadFiles(files: NgxFileDropEntry[]) { @@ -26,6 +28,7 @@ export class UploadDocumentsService { fileEntry.file((file: File) => { let formData = new FormData() formData.append('document', file, file.name) + formData.set('owner', this.settings.currentUser.id.toString()) let status = this.consumerStatusService.newFileUpload(file.name) status.message = $localize`Connecting...` diff --git a/src-ui/src/assets/bootstrap-icons.svg b/src-ui/src/assets/bootstrap-icons.svg index e94852cbd..61f2720db 100644 --- a/src-ui/src/assets/bootstrap-icons.svg +++ b/src-ui/src/assets/bootstrap-icons.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/src-ui/src/environments/environment.prod.ts b/src-ui/src/environments/environment.prod.ts index 5b1da2d7a..8130410f2 100644 --- a/src-ui/src/environments/environment.prod.ts +++ b/src-ui/src/environments/environment.prod.ts @@ -5,7 +5,7 @@ export const environment = { apiBaseUrl: document.baseURI + 'api/', apiVersion: '2', appTitle: 'Paperless-ngx', - version: '1.12.2-dev', + version: '1.13.0-dev', webSocketHost: window.location.host, webSocketProtocol: window.location.protocol == 'https:' ? 'wss:' : 'ws:', webSocketBaseUrl: base_url.pathname + 'ws/', diff --git a/src-ui/src/styles.scss b/src-ui/src/styles.scss index 7c67e3cf5..ed4efbe9d 100644 --- a/src-ui/src/styles.scss +++ b/src-ui/src/styles.scss @@ -255,6 +255,7 @@ a, a:hover, .paperless-input-tags { .ng-select.ng-select-multiple .ng-select-container .ng-value-container .ng-value { background-color: transparent; + border-color: transparent; } .ng-select.ng-select-multiple .ng-select-container .ng-value-container { @@ -607,3 +608,18 @@ a.badge { code { color: var(--pngx-body-color-accent) } + +.accordion { + --bs-accordion-btn-padding-x: 0.75rem; + --bs-accordion-btn-padding-y: 0.375rem; + --bs-accordion-btn-bg: var(--bs-light); + --bs-accordion-btn-color: var(--bs-primary); + --bs-accordion-color: var(--bs-body-color); + --bs-accordion-bg: var(--bs-light); + --bs-accordion-active-color: var(--bs-primary); + --bs-accordion-active-bg: var(--pngx-bg-alt); +} + +.accordion-button::after { + filter: invert(0.5) saturate(0); +} diff --git a/src-ui/src/theme.scss b/src-ui/src/theme.scss index a6273eaba..69fbc68cc 100644 --- a/src-ui/src/theme.scss +++ b/src-ui/src/theme.scss @@ -157,6 +157,19 @@ $form-check-radio-checked-bg-image-dark: url("data:image/svg+xml, (foo, bar, baz, file.pdf) + parts = [] + for part in filepath_relative.parts: + # If the part is not the name (ie, it's a dir) + # Need to append the trailing slash or fnmatch doesn't match + # fnmatch("dir", "dir/*") == False + # fnmatch("dir/", "dir/*") == True + if part != filepath_relative.name: + part = part + "/" + parts.append(part) + + for pattern in settings.CONSUMER_IGNORE_PATTERNS: + if len(filter(parts, pattern)): + return True + + return False -def _consume(filepath): +def _consume(filepath: str) -> None: if os.path.isdir(filepath) or _is_ignored(filepath): return @@ -103,7 +132,13 @@ def _consume(filepath): logger.exception("Error while consuming document") -def _consume_wait_unmodified(file): +def _consume_wait_unmodified(file: str) -> None: + """ + Waits for the given file to appear unmodified based on file size + and modification time. Will wait a configured number of seconds + and retry a configured number of times before either consuming or + giving up + """ if _is_ignored(file): return diff --git a/src/documents/migrations/1031_remove_savedview_user_correspondent_owner_and_more.py b/src/documents/migrations/1031_remove_savedview_user_correspondent_owner_and_more.py new file mode 100644 index 000000000..b187871e7 --- /dev/null +++ b/src/documents/migrations/1031_remove_savedview_user_correspondent_owner_and_more.py @@ -0,0 +1,87 @@ +# Generated by Django 4.1.4 on 2022-02-03 04:24 + +from django.conf import settings +from django.db import migrations, models +import django.db.models.deletion + + +class Migration(migrations.Migration): + + dependencies = [ + migrations.swappable_dependency(settings.AUTH_USER_MODEL), + ("documents", "1030_alter_paperlesstask_task_file_name"), + ] + + operations = [ + migrations.RenameField( + model_name="savedview", + old_name="user", + new_name="owner", + ), + migrations.AlterField( + model_name="savedview", + name="owner", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + verbose_name="owner", + ), + ), + migrations.AddField( + model_name="correspondent", + name="owner", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + verbose_name="owner", + ), + ), + migrations.AddField( + model_name="document", + name="owner", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + verbose_name="owner", + ), + ), + migrations.AddField( + model_name="documenttype", + name="owner", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + verbose_name="owner", + ), + ), + migrations.AddField( + model_name="storagepath", + name="owner", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + verbose_name="owner", + ), + ), + migrations.AddField( + model_name="tag", + name="owner", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + verbose_name="owner", + ), + ), + ] diff --git a/src/documents/models.py b/src/documents/models.py index 31b086992..77dc80944 100644 --- a/src/documents/models.py +++ b/src/documents/models.py @@ -60,14 +60,27 @@ class MatchingModel(models.Model): return self.name -class Correspondent(MatchingModel): +class ModelWithOwner(models.Model): + owner = models.ForeignKey( + User, + blank=True, + null=True, + on_delete=models.SET_NULL, + verbose_name=_("owner"), + ) + + class Meta: + abstract = True + + +class Correspondent(MatchingModel, ModelWithOwner): class Meta: ordering = ("name",) verbose_name = _("correspondent") verbose_name_plural = _("correspondents") -class Tag(MatchingModel): +class Tag(MatchingModel, ModelWithOwner): color = models.CharField(_("color"), max_length=7, default="#a6cee3") @@ -85,13 +98,13 @@ class Tag(MatchingModel): verbose_name_plural = _("tags") -class DocumentType(MatchingModel): +class DocumentType(MatchingModel, ModelWithOwner): class Meta: verbose_name = _("document type") verbose_name_plural = _("document types") -class StoragePath(MatchingModel): +class StoragePath(MatchingModel, ModelWithOwner): path = models.CharField( _("path"), max_length=512, @@ -103,7 +116,7 @@ class StoragePath(MatchingModel): verbose_name_plural = _("storage paths") -class Document(models.Model): +class Document(ModelWithOwner): STORAGE_TYPE_UNENCRYPTED = "unencrypted" STORAGE_TYPE_GPG = "gpg" @@ -369,14 +382,13 @@ class Log(models.Model): return self.message -class SavedView(models.Model): +class SavedView(ModelWithOwner): class Meta: ordering = ("name",) verbose_name = _("saved view") verbose_name_plural = _("saved views") - user = models.ForeignKey(User, on_delete=models.CASCADE, verbose_name=_("user")) name = models.CharField(_("name"), max_length=128) show_on_dashboard = models.BooleanField( diff --git a/src/documents/permissions.py b/src/documents/permissions.py new file mode 100644 index 000000000..c0e7ac345 --- /dev/null +++ b/src/documents/permissions.py @@ -0,0 +1,102 @@ +from django.contrib.auth.models import Group +from django.contrib.auth.models import Permission +from django.contrib.auth.models import User +from django.contrib.contenttypes.models import ContentType +from guardian.models import GroupObjectPermission +from guardian.shortcuts import assign_perm +from guardian.shortcuts import get_users_with_perms +from guardian.shortcuts import remove_perm +from rest_framework.permissions import BasePermission +from rest_framework.permissions import DjangoObjectPermissions + + +class PaperlessObjectPermissions(DjangoObjectPermissions): + """ + A permissions backend that checks for object-level permissions + or for ownership. + """ + + perms_map = { + "GET": ["%(app_label)s.view_%(model_name)s"], + "OPTIONS": ["%(app_label)s.view_%(model_name)s"], + "HEAD": ["%(app_label)s.view_%(model_name)s"], + "POST": ["%(app_label)s.add_%(model_name)s"], + "PUT": ["%(app_label)s.change_%(model_name)s"], + "PATCH": ["%(app_label)s.change_%(model_name)s"], + "DELETE": ["%(app_label)s.delete_%(model_name)s"], + } + + def has_object_permission(self, request, view, obj): + if hasattr(obj, "owner") and obj.owner is not None: + if request.user == obj.owner: + return True + else: + return super().has_object_permission(request, view, obj) + else: + return True # no owner + + +class PaperlessAdminPermissions(BasePermission): + def has_permission(self, request, view): + return request.user.has_perm("admin.view_logentry") + + +def get_groups_with_only_permission(obj, codename): + ctype = ContentType.objects.get_for_model(obj) + permission = Permission.objects.get(content_type=ctype, codename=codename) + group_object_perm_group_ids = ( + GroupObjectPermission.objects.filter( + object_pk=obj.pk, + content_type=ctype, + ) + .filter(permission=permission) + .values_list("group_id") + ) + return Group.objects.filter(id__in=group_object_perm_group_ids).distinct() + + +def set_permissions_for_object(permissions, object): + for action in permissions: + permission = f"{action}_{object.__class__.__name__.lower()}" + # users + users_to_add = User.objects.filter(id__in=permissions[action]["users"]) + users_to_remove = get_users_with_perms( + object, + only_with_perms_in=[permission], + ) + if len(users_to_add) > 0 and len(users_to_remove) > 0: + users_to_remove = users_to_remove.difference(users_to_add) + if len(users_to_remove) > 0: + for user in users_to_remove: + remove_perm(permission, user, object) + if len(users_to_add) > 0: + for user in users_to_add: + assign_perm(permission, user, object) + if action == "change": + # change gives view too + assign_perm( + f"view_{object.__class__.__name__.lower()}", + user, + object, + ) + # groups + groups_to_add = Group.objects.filter(id__in=permissions[action]["groups"]) + groups_to_remove = get_groups_with_only_permission( + object, + permission, + ) + if len(groups_to_add) > 0 and len(groups_to_remove) > 0: + groups_to_remove = groups_to_remove.difference(groups_to_add) + if len(groups_to_remove) > 0: + for group in groups_to_remove: + remove_perm(permission, group, object) + if len(groups_to_add) > 0: + for group in groups_to_add: + assign_perm(permission, group, object) + if action == "change": + # change gives view too + assign_perm( + f"view_{object.__class__.__name__.lower()}", + group, + object, + ) diff --git a/src/documents/serialisers.py b/src/documents/serialisers.py index 8282e46d6..a4199dd3d 100644 --- a/src/documents/serialisers.py +++ b/src/documents/serialisers.py @@ -28,6 +28,14 @@ from .models import UiSettings from .models import PaperlessTask from .parsers import is_mime_type_supported +from guardian.shortcuts import get_users_with_perms + +from django.contrib.auth.models import User +from django.contrib.auth.models import Group + +from documents.permissions import get_groups_with_only_permission +from documents.permissions import set_permissions_for_object + # https://www.django-rest-framework.org/api-guide/serializers/#example class DynamicFieldsModelSerializer(serializers.ModelSerializer): @@ -74,7 +82,114 @@ class MatchingModelSerializer(serializers.ModelSerializer): return match -class CorrespondentSerializer(MatchingModelSerializer): +class SetPermissionsMixin: + def _validate_user_ids(self, user_ids): + users = User.objects.none() + if user_ids is not None: + users = User.objects.filter(id__in=user_ids) + if not users.count() == len(user_ids): + raise serializers.ValidationError( + "Some users in don't exist or were specified twice.", + ) + return users + + def _validate_group_ids(self, group_ids): + groups = Group.objects.none() + if group_ids is not None: + groups = Group.objects.filter(id__in=group_ids) + if not groups.count() == len(group_ids): + raise serializers.ValidationError( + "Some groups in don't exist or were specified twice.", + ) + return groups + + def validate_set_permissions(self, set_permissions=None): + permissions_dict = { + "view": { + "users": User.objects.none(), + "groups": Group.objects.none(), + }, + "change": { + "users": User.objects.none(), + "groups": Group.objects.none(), + }, + } + if set_permissions is not None: + for action in permissions_dict: + if action in set_permissions: + users = set_permissions[action]["users"] + permissions_dict[action]["users"] = self._validate_user_ids(users) + groups = set_permissions[action]["groups"] + permissions_dict[action]["groups"] = self._validate_group_ids( + groups, + ) + return permissions_dict + + def _set_permissions(self, permissions, object): + set_permissions_for_object(permissions, object) + + +class OwnedObjectSerializer(serializers.ModelSerializer, SetPermissionsMixin): + def __init__(self, *args, **kwargs): + self.user = kwargs.pop("user", None) + return super().__init__(*args, **kwargs) + + def get_permissions(self, obj): + view_codename = f"view_{obj.__class__.__name__.lower()}" + change_codename = f"change_{obj.__class__.__name__.lower()}" + return { + "view": { + "users": get_users_with_perms( + obj, + only_with_perms_in=[view_codename], + ).values_list("id", flat=True), + "groups": get_groups_with_only_permission( + obj, + codename=view_codename, + ).values_list("id", flat=True), + }, + "change": { + "users": get_users_with_perms( + obj, + only_with_perms_in=[change_codename], + ).values_list("id", flat=True), + "groups": get_groups_with_only_permission( + obj, + codename=change_codename, + ).values_list("id", flat=True), + }, + } + + permissions = SerializerMethodField(read_only=True) + + set_permissions = serializers.DictField( + label="Set permissions", + allow_empty=True, + required=False, + write_only=True, + ) + # other methods in mixin + + def create(self, validated_data): + if self.user and ( + "owner" not in validated_data or validated_data["owner"] is None + ): + validated_data["owner"] = self.user + permissions = None + if "set_permissions" in validated_data: + permissions = validated_data.pop("set_permissions") + instance = super().create(validated_data) + if permissions is not None: + self._set_permissions(permissions, instance) + return instance + + def update(self, instance, validated_data): + if "set_permissions" in validated_data: + self._set_permissions(validated_data["set_permissions"], instance) + return super().update(instance, validated_data) + + +class CorrespondentSerializer(MatchingModelSerializer, OwnedObjectSerializer): last_correspondence = serializers.DateTimeField(read_only=True) @@ -89,10 +204,13 @@ class CorrespondentSerializer(MatchingModelSerializer): "is_insensitive", "document_count", "last_correspondence", + "owner", + "permissions", + "set_permissions", ) -class DocumentTypeSerializer(MatchingModelSerializer): +class DocumentTypeSerializer(MatchingModelSerializer, OwnedObjectSerializer): class Meta: model = DocumentType fields = ( @@ -103,6 +221,9 @@ class DocumentTypeSerializer(MatchingModelSerializer): "matching_algorithm", "is_insensitive", "document_count", + "owner", + "permissions", + "set_permissions", ) @@ -137,7 +258,7 @@ class ColorField(serializers.Field): return 1 -class TagSerializerVersion1(MatchingModelSerializer): +class TagSerializerVersion1(MatchingModelSerializer, OwnedObjectSerializer): colour = ColorField(source="color", default="#a6cee3") @@ -153,10 +274,13 @@ class TagSerializerVersion1(MatchingModelSerializer): "is_insensitive", "is_inbox_tag", "document_count", + "owner", + "permissions", + "set_permissions", ) -class TagSerializer(MatchingModelSerializer): +class TagSerializer(MatchingModelSerializer, OwnedObjectSerializer): def get_text_color(self, obj): try: h = obj.color.lstrip("#") @@ -185,6 +309,9 @@ class TagSerializer(MatchingModelSerializer): "is_insensitive", "is_inbox_tag", "document_count", + "owner", + "permissions", + "set_permissions", ) def validate_color(self, color): @@ -214,7 +341,7 @@ class StoragePathField(serializers.PrimaryKeyRelatedField): return StoragePath.objects.all() -class DocumentSerializer(DynamicFieldsModelSerializer): +class DocumentSerializer(OwnedObjectSerializer, DynamicFieldsModelSerializer): correspondent = CorrespondentField(allow_null=True) tags = TagsField(many=True) @@ -225,6 +352,12 @@ class DocumentSerializer(DynamicFieldsModelSerializer): archived_file_name = SerializerMethodField() created_date = serializers.DateField(required=False) + owner = serializers.PrimaryKeyRelatedField( + queryset=User.objects.all(), + required=False, + allow_null=True, + ) + def get_original_file_name(self, obj): return obj.get_public_filename() @@ -276,6 +409,9 @@ class DocumentSerializer(DynamicFieldsModelSerializer): "archive_serial_number", "original_file_name", "archived_file_name", + "owner", + "permissions", + "set_permissions", ) @@ -285,7 +421,7 @@ class SavedViewFilterRuleSerializer(serializers.ModelSerializer): fields = ["rule_type", "value"] -class SavedViewSerializer(serializers.ModelSerializer): +class SavedViewSerializer(OwnedObjectSerializer): filter_rules = SavedViewFilterRuleSerializer(many=True) @@ -300,6 +436,9 @@ class SavedViewSerializer(serializers.ModelSerializer): "sort_field", "sort_reverse", "filter_rules", + "owner", + "permissions", + "set_permissions", ] def update(self, instance, validated_data): @@ -307,6 +446,9 @@ class SavedViewSerializer(serializers.ModelSerializer): rules_data = validated_data.pop("filter_rules") else: rules_data = None + if "user" in validated_data: + # backwards compatibility + validated_data["owner"] = validated_data.pop("user") super().update(instance, validated_data) if rules_data is not None: SavedViewFilterRule.objects.filter(saved_view=instance).delete() @@ -316,6 +458,9 @@ class SavedViewSerializer(serializers.ModelSerializer): def create(self, validated_data): rules_data = validated_data.pop("filter_rules") + if "user" in validated_data: + # backwards compatibility + validated_data["owner"] = validated_data.pop("user") saved_view = SavedView.objects.create(**validated_data) for rule_data in rules_data: SavedViewFilterRule.objects.create(saved_view=saved_view, **rule_data) @@ -347,7 +492,7 @@ class DocumentListSerializer(serializers.Serializer): return documents -class BulkEditSerializer(DocumentListSerializer): +class BulkEditSerializer(DocumentListSerializer, SetPermissionsMixin): method = serializers.ChoiceField( choices=[ @@ -359,6 +504,7 @@ class BulkEditSerializer(DocumentListSerializer): "modify_tags", "delete", "redo_ocr", + "set_permissions", ], label="Method", write_only=True, @@ -394,6 +540,8 @@ class BulkEditSerializer(DocumentListSerializer): return bulk_edit.delete elif method == "redo_ocr": return bulk_edit.redo_ocr + elif method == "set_permissions": + return bulk_edit.set_permissions else: raise serializers.ValidationError("Unsupported method.") @@ -457,6 +605,19 @@ class BulkEditSerializer(DocumentListSerializer): else: raise serializers.ValidationError("remove_tags not specified") + def _validate_owner(self, owner): + ownerUser = User.objects.get(pk=owner) + if ownerUser is None: + raise serializers.ValidationError("Specified owner cannot be found") + return ownerUser + + def _validate_parameters_set_permissions(self, parameters): + parameters["set_permissions"] = self.validate_set_permissions( + parameters["set_permissions"], + ) + if "owner" in parameters and parameters["owner"] is not None: + self._validate_owner(parameters["owner"]) + def validate(self, attrs): method = attrs["method"] @@ -472,6 +633,8 @@ class BulkEditSerializer(DocumentListSerializer): self._validate_parameters_modify_tags(parameters) elif method == bulk_edit.set_storage_path: self._validate_storage_path(parameters) + elif method == bulk_edit.set_permissions: + self._validate_parameters_set_permissions(parameters) return attrs @@ -520,6 +683,14 @@ class PostDocumentSerializer(serializers.Serializer): required=False, ) + owner = serializers.PrimaryKeyRelatedField( + queryset=User.objects.all(), + label="Owner", + allow_null=True, + write_only=True, + required=False, + ) + def validate_document(self, document): document_data = document.file.read() mime_type = magic.from_buffer(document_data, mime=True) @@ -549,6 +720,12 @@ class PostDocumentSerializer(serializers.Serializer): else: return None + def validate_owner(self, owner): + if owner: + return owner.id + else: + return None + class BulkDownloadSerializer(DocumentListSerializer): @@ -577,7 +754,7 @@ class BulkDownloadSerializer(DocumentListSerializer): }[compression] -class StoragePathSerializer(MatchingModelSerializer): +class StoragePathSerializer(MatchingModelSerializer, OwnedObjectSerializer): class Meta: model = StoragePath fields = ( @@ -589,6 +766,9 @@ class StoragePathSerializer(MatchingModelSerializer): "matching_algorithm", "is_insensitive", "document_count", + "owner", + "permissions", + "set_permissions", ) def validate_path(self, path): @@ -621,6 +801,17 @@ class StoragePathSerializer(MatchingModelSerializer): return path + def update(self, instance, validated_data): + """ + When a storage path is updated, see if documents + using it require a rename/move + """ + doc_ids = [doc.id for doc in instance.documents.all()] + if len(doc_ids): + bulk_edit.bulk_update_documents.delay(doc_ids) + + return super().update(instance, validated_data) + class UiSettingsViewSerializer(serializers.ModelSerializer): class Meta: diff --git a/src/documents/signals/handlers.py b/src/documents/signals/handlers.py index cd42c9030..670ceae64 100644 --- a/src/documents/signals/handlers.py +++ b/src/documents/signals/handlers.py @@ -384,7 +384,7 @@ def validate_move(instance, old_path, new_path): @receiver(models.signals.m2m_changed, sender=Document.tags.through) @receiver(models.signals.post_save, sender=Document) -def update_filename_and_move_files(sender, instance, **kwargs): +def update_filename_and_move_files(sender, instance: Document, **kwargs): if not instance.filename: # Can't update the filename if there is no filename to begin with diff --git a/src/documents/tasks.py b/src/documents/tasks.py index 1f9c94917..c3064cc10 100644 --- a/src/documents/tasks.py +++ b/src/documents/tasks.py @@ -12,6 +12,7 @@ from asgiref.sync import async_to_sync from celery import shared_task from channels.layers import get_channel_layer from django.conf import settings +from django.contrib.auth.models import User from django.db import transaction from django.db.models.signals import post_save from documents import barcodes @@ -95,6 +96,7 @@ def consume_file( override_tag_ids=None, task_id=None, override_created=None, + override_owner_id=None, ): path = Path(path).resolve() @@ -206,6 +208,7 @@ def consume_file( task_id=task_id, override_created=override_created, override_asn=asn, + override_owner_id=override_owner_id, ) if document: @@ -307,3 +310,12 @@ def update_document_archive_file(document_id): ) finally: parser.cleanup() + + +@shared_task +def update_owner_for_object(document_ids, owner): + documents = Document.objects.filter(id__in=document_ids) + ownerUser = User.objects.get(pk=owner) if owner is not None else None + for document in documents: + document.owner = ownerUser if owner is not None else None + document.save() diff --git a/src/documents/tests/test_api.py b/src/documents/tests/test_api.py index 38ab46b91..3d3ab9bbc 100644 --- a/src/documents/tests/test_api.py +++ b/src/documents/tests/test_api.py @@ -21,6 +21,8 @@ except ImportError: import pytest from django.conf import settings +from django.contrib.auth.models import Group +from django.contrib.auth.models import Permission from django.contrib.auth.models import User from django.test import override_settings from django.utils import timezone @@ -41,6 +43,8 @@ from paperless import version from rest_framework.test import APITestCase from whoosh.writing import AsyncWriter +from guardian.shortcuts import get_users_with_perms + class TestDocumentApi(DirectoriesMixin, APITestCase): def setUp(self): @@ -158,7 +162,7 @@ class TestDocumentApi(DirectoriesMixin, APITestCase): response = self.client.get("/api/documents/?fields=", format="json") self.assertEqual(response.status_code, 200) results = response.data["results"] - self.assertEqual(results_full, results) + self.assertEqual(len(results_full[0]), len(results[0])) response = self.client.get("/api/documents/?fields=dgfhs", format="json") self.assertEqual(response.status_code, 200) @@ -1454,25 +1458,25 @@ class TestDocumentApi(DirectoriesMixin, APITestCase): ) def test_saved_views(self): - u1 = User.objects.create_user("user1") - u2 = User.objects.create_user("user2") + u1 = User.objects.create_superuser("user1") + u2 = User.objects.create_superuser("user2") v1 = SavedView.objects.create( - user=u1, + owner=u1, name="test1", sort_field="", show_on_dashboard=False, show_in_sidebar=False, ) v2 = SavedView.objects.create( - user=u2, + owner=u2, name="test2", sort_field="", show_on_dashboard=False, show_in_sidebar=False, ) v3 = SavedView.objects.create( - user=u2, + owner=u2, name="test3", sort_field="", show_on_dashboard=False, @@ -1519,7 +1523,7 @@ class TestDocumentApi(DirectoriesMixin, APITestCase): v1 = SavedView.objects.get(name="test") self.assertEqual(v1.sort_field, "created2") self.assertEqual(v1.filter_rules.count(), 1) - self.assertEqual(v1.user, self.user) + self.assertEqual(v1.owner, self.user) response = self.client.patch( f"/api/saved_views/{v1.id}/", @@ -1702,8 +1706,8 @@ class TestDocumentApi(DirectoriesMixin, APITestCase): "user": { "id": comment.user.id, "username": comment.user.username, - "firstname": comment.user.first_name, - "lastname": comment.user.last_name, + "first_name": comment.user.first_name, + "last_name": comment.user.last_name, }, }, ) @@ -2629,6 +2633,41 @@ class TestBulkEdit(DirectoriesMixin, APITestCase): ], ) + @mock.patch("documents.serialisers.bulk_edit.set_permissions") + def test_set_permissions(self, m): + m.return_value = "OK" + user1 = User.objects.create(username="user1") + user2 = User.objects.create(username="user2") + permissions = { + "view": { + "users": [user1.id, user2.id], + "groups": None, + }, + "change": { + "users": [user1.id], + "groups": None, + }, + } + + response = self.client.post( + "/api/documents/bulk_edit/", + json.dumps( + { + "documents": [self.doc2.id, self.doc3.id], + "method": "set_permissions", + "parameters": {"set_permissions": permissions}, + }, + ), + content_type="application/json", + ) + + self.assertEqual(response.status_code, 200) + + m.assert_called_once() + args, kwargs = m.call_args + self.assertCountEqual(args[0], [self.doc2.id, self.doc3.id]) + self.assertEqual(len(kwargs["set_permissions"]["view"]["users"]), 2) + class TestBulkDownload(DirectoriesMixin, APITestCase): @@ -3003,6 +3042,59 @@ class TestApiAuth(DirectoriesMixin, APITestCase): self.assertIn("X-Api-Version", response) self.assertIn("X-Version", response) + def test_api_insufficient_permissions(self): + user = User.objects.create_user(username="test") + self.client.force_authenticate(user) + + d = Document.objects.create(title="Test") + + self.assertEqual(self.client.get("/api/documents/").status_code, 403) + + self.assertEqual(self.client.get("/api/tags/").status_code, 403) + self.assertEqual(self.client.get("/api/correspondents/").status_code, 403) + self.assertEqual(self.client.get("/api/document_types/").status_code, 403) + + self.assertEqual(self.client.get("/api/logs/").status_code, 403) + self.assertEqual(self.client.get("/api/saved_views/").status_code, 403) + + def test_api_sufficient_permissions(self): + user = User.objects.create_user(username="test") + user.user_permissions.add(*Permission.objects.all()) + self.client.force_authenticate(user) + + d = Document.objects.create(title="Test") + + self.assertEqual(self.client.get("/api/documents/").status_code, 200) + + self.assertEqual(self.client.get("/api/tags/").status_code, 200) + self.assertEqual(self.client.get("/api/correspondents/").status_code, 200) + self.assertEqual(self.client.get("/api/document_types/").status_code, 200) + + self.assertEqual(self.client.get("/api/logs/").status_code, 200) + self.assertEqual(self.client.get("/api/saved_views/").status_code, 200) + + def test_object_permissions(self): + user1 = User.objects.create_user(username="test1") + user2 = User.objects.create_user(username="test2") + user1.user_permissions.add(*Permission.objects.filter(codename="view_document")) + self.client.force_authenticate(user1) + + self.assertEqual(self.client.get("/api/documents/").status_code, 200) + + d = Document.objects.create(title="Test", content="the content 1", checksum="1") + + # no owner + self.assertEqual(self.client.get(f"/api/documents/{d.id}/").status_code, 200) + + d2 = Document.objects.create( + title="Test 2", + content="the content 2", + checksum="2", + owner=user2, + ) + + self.assertEqual(self.client.get(f"/api/documents/{d2.id}/").status_code, 404) + class TestApiRemoteVersion(DirectoriesMixin, APITestCase): ENDPOINT = "/api/remote_version/" @@ -3128,7 +3220,7 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase): def setUp(self) -> None: super().setUp() - user = User.objects.create(username="temp_admin") + user = User.objects.create_superuser(username="temp_admin") self.client.force_authenticate(user=user) self.sp1 = StoragePath.objects.create(name="sp1", path="Something/{checksum}") @@ -3143,7 +3235,6 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase): - Existing storage paths are returned """ response = self.client.get(self.ENDPOINT, format="json") - self.assertEqual(response.status_code, 200) self.assertEqual(response.status_code, 200) self.assertEqual(response.data["count"], 1) @@ -3215,7 +3306,12 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase): json.dumps( { "name": "Storage path with placeholders", - "path": "{title}/{correspondent}/{document_type}/{created}/{created_year}/{created_year_short}/{created_month}/{created_month_name}/{created_month_name_short}/{created_day}/{added}/{added_year}/{added_year_short}/{added_month}/{added_month_name}/{added_month_name_short}/{added_day}/{asn}/{tags}/{tag_list}/", + "path": "{title}/{correspondent}/{document_type}/{created}/{created_year}" + "/{created_year_short}/{created_month}/{created_month_name}" + "/{created_month_name_short}/{created_day}/{added}/{added_year}" + "/{added_year_short}/{added_month}/{added_month_name}" + "/{added_month_name_short}/{added_day}/{asn}/{tags}" + "/{tag_list}/", }, ), content_type="application/json", @@ -3223,6 +3319,35 @@ class TestApiStoragePaths(DirectoriesMixin, APITestCase): self.assertEqual(response.status_code, 201) self.assertEqual(StoragePath.objects.count(), 2) + @mock.patch("documents.bulk_edit.bulk_update_documents.delay") + def test_api_update_storage_path(self, bulk_update_mock): + """ + GIVEN: + - API request to get all storage paths + WHEN: + - API is called + THEN: + - Existing storage paths are returned + """ + document = Document.objects.create( + mime_type="application/pdf", + storage_path=self.sp1, + ) + response = self.client.patch( + f"{self.ENDPOINT}{self.sp1.pk}/", + data={ + "path": "somewhere/{created} - {title}", + }, + ) + + self.assertEqual(response.status_code, 200) + + bulk_update_mock.assert_called_once() + + args, _ = bulk_update_mock.call_args + + self.assertCountEqual([document.pk], args[0]) + class TestTasks(DirectoriesMixin, APITestCase): ENDPOINT = "/api/tasks/" @@ -3261,11 +3386,6 @@ class TestTasks(DirectoriesMixin, APITestCase): returned_task1 = response.data[1] returned_task2 = response.data[0] - from pprint import pprint - - pprint(returned_task1) - pprint(returned_task2) - self.assertEqual(returned_task1["task_id"], task1.task_id) self.assertEqual(returned_task1["status"], celery.states.PENDING) self.assertEqual(returned_task1["task_file_name"], task1.task_file_name) @@ -3458,3 +3578,246 @@ class TestTasks(DirectoriesMixin, APITestCase): returned_data = response.data[0] self.assertEqual(returned_data["task_file_name"], "anothertest.pdf") + + +class TestApiUser(APITestCase): + ENDPOINT = "/api/users/" + + def setUp(self): + super().setUp() + + self.user = User.objects.create_superuser(username="temp_admin") + self.client.force_authenticate(user=self.user) + + def test_get_users(self): + """ + GIVEN: + - Configured users + WHEN: + - API call is made to get users + THEN: + - Configured users are provided + """ + + user1 = User.objects.create( + username="testuser", + password="test", + first_name="Test", + last_name="User", + ) + + response = self.client.get(self.ENDPOINT) + + self.assertEqual(response.status_code, 200) + self.assertEqual(response.data["count"], 2) + returned_user2 = response.data["results"][1] + + self.assertEqual(returned_user2["username"], user1.username) + self.assertEqual(returned_user2["password"], "**********") + self.assertEqual(returned_user2["first_name"], user1.first_name) + self.assertEqual(returned_user2["last_name"], user1.last_name) + + def test_create_user(self): + """ + WHEN: + - API request is made to add a user account + THEN: + - A new user account is created + """ + + user1 = { + "username": "testuser", + "password": "test", + "first_name": "Test", + "last_name": "User", + } + + response = self.client.post( + self.ENDPOINT, + data=user1, + ) + + self.assertEqual(response.status_code, 201) + + returned_user1 = User.objects.get(username="testuser") + + self.assertEqual(returned_user1.username, user1["username"]) + self.assertEqual(returned_user1.first_name, user1["first_name"]) + self.assertEqual(returned_user1.last_name, user1["last_name"]) + + def test_delete_user(self): + """ + GIVEN: + - Existing user account + WHEN: + - API request is made to delete a user account + THEN: + - Account is deleted + """ + + user1 = User.objects.create( + username="testuser", + password="test", + first_name="Test", + last_name="User", + ) + + nUsers = User.objects.count() + + response = self.client.delete( + f"{self.ENDPOINT}{user1.pk}/", + ) + + self.assertEqual(response.status_code, 204) + + self.assertEqual(User.objects.count(), nUsers - 1) + + def test_update_user(self): + """ + GIVEN: + - Existing user accounts + WHEN: + - API request is made to update user account + THEN: + - The user account is updated, password only updated if not '****' + """ + + user1 = User.objects.create( + username="testuser", + password="test", + first_name="Test", + last_name="User", + ) + + initial_password = user1.password + + response = self.client.patch( + f"{self.ENDPOINT}{user1.pk}/", + data={ + "first_name": "Updated Name 1", + "password": "******", + }, + ) + + self.assertEqual(response.status_code, 200) + + returned_user1 = User.objects.get(pk=user1.pk) + self.assertEqual(returned_user1.first_name, "Updated Name 1") + self.assertEqual(returned_user1.password, initial_password) + + response = self.client.patch( + f"{self.ENDPOINT}{user1.pk}/", + data={ + "first_name": "Updated Name 2", + "password": "123xyz", + }, + ) + + self.assertEqual(response.status_code, 200) + + returned_user2 = User.objects.get(pk=user1.pk) + self.assertEqual(returned_user2.first_name, "Updated Name 2") + self.assertNotEqual(returned_user2.password, initial_password) + + +class TestApiGroup(APITestCase): + ENDPOINT = "/api/groups/" + + def setUp(self): + super().setUp() + + self.user = User.objects.create_superuser(username="temp_admin") + self.client.force_authenticate(user=self.user) + + def test_get_groups(self): + """ + GIVEN: + - Configured groups + WHEN: + - API call is made to get groups + THEN: + - Configured groups are provided + """ + + group1 = Group.objects.create( + name="Test Group", + ) + + response = self.client.get(self.ENDPOINT) + + self.assertEqual(response.status_code, 200) + self.assertEqual(response.data["count"], 1) + returned_group1 = response.data["results"][0] + + self.assertEqual(returned_group1["name"], group1.name) + + def test_create_group(self): + """ + WHEN: + - API request is made to add a group + THEN: + - A new group is created + """ + + group1 = { + "name": "Test Group", + } + + response = self.client.post( + self.ENDPOINT, + data=group1, + ) + + self.assertEqual(response.status_code, 201) + + returned_group1 = Group.objects.get(name="Test Group") + + self.assertEqual(returned_group1.name, group1["name"]) + + def test_delete_group(self): + """ + GIVEN: + - Existing group + WHEN: + - API request is made to delete a group + THEN: + - Group is deleted + """ + + group1 = Group.objects.create( + name="Test Group", + ) + + response = self.client.delete( + f"{self.ENDPOINT}{group1.pk}/", + ) + + self.assertEqual(response.status_code, 204) + + self.assertEqual(len(Group.objects.all()), 0) + + def test_update_group(self): + """ + GIVEN: + - Existing groups + WHEN: + - API request is made to update group + THEN: + - The group is updated + """ + + group1 = Group.objects.create( + name="Test Group", + ) + + response = self.client.patch( + f"{self.ENDPOINT}{group1.pk}/", + data={ + "name": "Updated Name 1", + }, + ) + + self.assertEqual(response.status_code, 200) + + returned_group1 = Group.objects.get(pk=group1.pk) + self.assertEqual(returned_group1.name, "Updated Name 1") diff --git a/src/documents/tests/test_file_handling.py b/src/documents/tests/test_file_handling.py index 8d726b339..2c91f2e0d 100644 --- a/src/documents/tests/test_file_handling.py +++ b/src/documents/tests/test_file_handling.py @@ -1,9 +1,6 @@ import datetime -import hashlib import os -import random import tempfile -import uuid from pathlib import Path from unittest import mock @@ -13,10 +10,10 @@ from django.test import override_settings from django.test import TestCase from django.utils import timezone +from ..bulk_edit import bulk_update_documents from ..file_handling import create_source_path_directory from ..file_handling import delete_empty_directories from ..file_handling import generate_filename -from ..file_handling import generate_unique_filename from ..models import Correspondent from ..models import Document from ..models import DocumentType @@ -871,7 +868,7 @@ class TestFileHandlingWithArchive(DirectoriesMixin, TestCase): self.assertTrue(os.path.isfile(doc.archive_path)) -class TestFilenameGeneration(TestCase): +class TestFilenameGeneration(DirectoriesMixin, TestCase): @override_settings(FILENAME_FORMAT="{title}") def test_invalid_characters(self): @@ -1063,28 +1060,3 @@ class TestFilenameGeneration(TestCase): checksum="2", ) self.assertEqual(generate_filename(doc), "84/August/Aug/The Title.pdf") - - -def run(): - doc = Document.objects.create( - checksum=str(uuid.uuid4()), - title=str(uuid.uuid4()), - content="wow", - ) - doc.filename = generate_unique_filename(doc) - Path(doc.thumbnail_path).touch() - with open(doc.source_path, "w") as f: - f.write(str(uuid.uuid4())) - with open(doc.source_path, "rb") as f: - doc.checksum = hashlib.md5(f.read()).hexdigest() - - with open(doc.archive_path, "w") as f: - f.write(str(uuid.uuid4())) - with open(doc.archive_path, "rb") as f: - doc.archive_checksum = hashlib.md5(f.read()).hexdigest() - - doc.save() - - for i in range(30): - doc.title = str(random.randrange(1, 5)) - doc.save() diff --git a/src/documents/tests/test_management_consumer.py b/src/documents/tests/test_management_consumer.py index 822a7ed07..3db8de034 100644 --- a/src/documents/tests/test_management_consumer.py +++ b/src/documents/tests/test_management_consumer.py @@ -247,22 +247,85 @@ class TestConsumer(DirectoriesMixin, ConsumerMixin, TransactionTestCase): def test_is_ignored(self): test_paths = [ - (os.path.join(self.dirs.consumption_dir, "foo.pdf"), False), - (os.path.join(self.dirs.consumption_dir, "foo", "bar.pdf"), False), - (os.path.join(self.dirs.consumption_dir, ".DS_STORE", "foo.pdf"), True), - ( - os.path.join(self.dirs.consumption_dir, "foo", ".DS_STORE", "bar.pdf"), - True, - ), - (os.path.join(self.dirs.consumption_dir, ".stfolder", "foo.pdf"), True), - (os.path.join(self.dirs.consumption_dir, "._foo.pdf"), True), - (os.path.join(self.dirs.consumption_dir, "._foo", "bar.pdf"), False), + { + "path": os.path.join(self.dirs.consumption_dir, "foo.pdf"), + "ignore": False, + }, + { + "path": os.path.join(self.dirs.consumption_dir, "foo", "bar.pdf"), + "ignore": False, + }, + { + "path": os.path.join(self.dirs.consumption_dir, ".DS_STORE", "foo.pdf"), + "ignore": True, + }, + { + "path": os.path.join( + self.dirs.consumption_dir, + "foo", + ".DS_STORE", + "bar.pdf", + ), + "ignore": True, + }, + { + "path": os.path.join( + self.dirs.consumption_dir, + ".DS_STORE", + "foo", + "bar.pdf", + ), + "ignore": True, + }, + { + "path": os.path.join(self.dirs.consumption_dir, ".stfolder", "foo.pdf"), + "ignore": True, + }, + { + "path": os.path.join(self.dirs.consumption_dir, ".stfolder.pdf"), + "ignore": False, + }, + { + "path": os.path.join( + self.dirs.consumption_dir, + ".stversions", + "foo.pdf", + ), + "ignore": True, + }, + { + "path": os.path.join(self.dirs.consumption_dir, ".stversions.pdf"), + "ignore": False, + }, + { + "path": os.path.join(self.dirs.consumption_dir, "._foo.pdf"), + "ignore": True, + }, + { + "path": os.path.join(self.dirs.consumption_dir, "my_foo.pdf"), + "ignore": False, + }, + { + "path": os.path.join(self.dirs.consumption_dir, "._foo", "bar.pdf"), + "ignore": True, + }, + { + "path": os.path.join( + self.dirs.consumption_dir, + "@eaDir", + "SYNO@.fileindexdb", + "_1jk.fnm", + ), + "ignore": True, + }, ] - for file_path, expected_ignored in test_paths: + for test_setup in test_paths: + filepath = test_setup["path"] + expected_ignored_result = test_setup["ignore"] self.assertEqual( - expected_ignored, - document_consumer._is_ignored(file_path), - f'_is_ignored("{file_path}") != {expected_ignored}', + expected_ignored_result, + document_consumer._is_ignored(filepath), + f'_is_ignored("{filepath}") != {expected_ignored_result}', ) @mock.patch("documents.management.commands.document_consumer.open") diff --git a/src/documents/tests/test_management_exporter.py b/src/documents/tests/test_management_exporter.py index 0d815a602..484065810 100644 --- a/src/documents/tests/test_management_exporter.py +++ b/src/documents/tests/test_management_exporter.py @@ -139,7 +139,7 @@ class TestExportImport(DirectoriesMixin, TestCase): manifest = self._do_export(use_filename_format=use_filename_format) - self.assertEqual(len(manifest), 11) + self.assertEqual(len(manifest), 12) self.assertEqual( len(list(filter(lambda e: e["model"] == "documents.document", manifest))), 4, diff --git a/src/documents/tests/test_management_superuser.py b/src/documents/tests/test_management_superuser.py index d5fa86ce3..b79a9f9a6 100644 --- a/src/documents/tests/test_management_superuser.py +++ b/src/documents/tests/test_management_superuser.py @@ -31,8 +31,8 @@ class TestManageSuperUser(DirectoriesMixin, TestCase): out = self.call_command(environ={}) # just the consumer user which is created - # during migration - self.assertEqual(User.objects.count(), 1) + # during migration, and AnonymousUser + self.assertEqual(User.objects.count(), 2) self.assertTrue(User.objects.filter(username="consumer").exists()) self.assertEqual(User.objects.filter(is_superuser=True).count(), 0) self.assertEqual( @@ -50,10 +50,10 @@ class TestManageSuperUser(DirectoriesMixin, TestCase): out = self.call_command(environ={"PAPERLESS_ADMIN_PASSWORD": "123456"}) - # count is 2 as there's the consumer - # user already created during migration + # count is 3 as there's the consumer + # user already created during migration, and AnonymousUser user: User = User.objects.get_by_natural_key("admin") - self.assertEqual(User.objects.count(), 2) + self.assertEqual(User.objects.count(), 3) self.assertTrue(user.is_superuser) self.assertEqual(user.email, "root@localhost") self.assertEqual(out, 'Created superuser "admin" with provided password.\n') @@ -70,7 +70,7 @@ class TestManageSuperUser(DirectoriesMixin, TestCase): out = self.call_command(environ={"PAPERLESS_ADMIN_PASSWORD": "123456"}) - self.assertEqual(User.objects.count(), 2) + self.assertEqual(User.objects.count(), 3) with self.assertRaises(User.DoesNotExist): User.objects.get_by_natural_key("admin") self.assertEqual( @@ -91,7 +91,7 @@ class TestManageSuperUser(DirectoriesMixin, TestCase): out = self.call_command(environ={"PAPERLESS_ADMIN_PASSWORD": "123456"}) - self.assertEqual(User.objects.count(), 2) + self.assertEqual(User.objects.count(), 3) user: User = User.objects.get_by_natural_key("admin") self.assertTrue(user.check_password("password")) self.assertEqual(out, "Did not create superuser, a user admin already exists\n") @@ -110,7 +110,7 @@ class TestManageSuperUser(DirectoriesMixin, TestCase): out = self.call_command(environ={"PAPERLESS_ADMIN_PASSWORD": "123456"}) - self.assertEqual(User.objects.count(), 2) + self.assertEqual(User.objects.count(), 3) user: User = User.objects.get_by_natural_key("admin") self.assertTrue(user.check_password("password")) self.assertFalse(user.is_superuser) @@ -149,7 +149,7 @@ class TestManageSuperUser(DirectoriesMixin, TestCase): ) user: User = User.objects.get_by_natural_key("admin") - self.assertEqual(User.objects.count(), 2) + self.assertEqual(User.objects.count(), 3) self.assertTrue(user.is_superuser) self.assertEqual(user.email, "hello@world.com") self.assertEqual(user.username, "admin") @@ -173,7 +173,7 @@ class TestManageSuperUser(DirectoriesMixin, TestCase): ) user: User = User.objects.get_by_natural_key("super") - self.assertEqual(User.objects.count(), 2) + self.assertEqual(User.objects.count(), 3) self.assertTrue(user.is_superuser) self.assertEqual(user.email, "hello@world.com") self.assertEqual(user.username, "super") diff --git a/src/documents/views.py b/src/documents/views.py index 6a719fe70..89a30636e 100644 --- a/src/documents/views.py +++ b/src/documents/views.py @@ -2,6 +2,7 @@ import itertools import json import logging import os +import re import tempfile import urllib import uuid @@ -30,6 +31,9 @@ from django.utils.translation import get_language from django.views.decorators.cache import cache_control from django.views.generic import TemplateView from django_filters.rest_framework import DjangoFilterBackend +from documents.filters import ObjectOwnedOrGrantedPermissionsFilter +from documents.permissions import PaperlessAdminPermissions +from documents.permissions import PaperlessObjectPermissions from documents.tasks import consume_file from langdetect import detect from packaging import version as packaging_version @@ -42,6 +46,7 @@ from rest_framework.exceptions import NotFound from rest_framework.filters import OrderingFilter from rest_framework.filters import SearchFilter from rest_framework.generics import GenericAPIView +from rest_framework.mixins import CreateModelMixin from rest_framework.mixins import DestroyModelMixin from rest_framework.mixins import ListModelMixin from rest_framework.mixins import RetrieveModelMixin @@ -137,7 +142,17 @@ class IndexView(TemplateView): return context -class CorrespondentViewSet(ModelViewSet): +class PassUserMixin(CreateModelMixin): + """ + Pass a user object to serializer + """ + + def get_serializer(self, *args, **kwargs): + kwargs.setdefault("user", self.request.user) + return super().get_serializer(*args, **kwargs) + + +class CorrespondentViewSet(ModelViewSet, PassUserMixin): model = Correspondent queryset = Correspondent.objects.annotate( @@ -147,8 +162,12 @@ class CorrespondentViewSet(ModelViewSet): serializer_class = CorrespondentSerializer pagination_class = StandardPagination - permission_classes = (IsAuthenticated,) - filter_backends = (DjangoFilterBackend, OrderingFilter) + permission_classes = (IsAuthenticated, PaperlessObjectPermissions) + filter_backends = ( + DjangoFilterBackend, + OrderingFilter, + ObjectOwnedOrGrantedPermissionsFilter, + ) filterset_class = CorrespondentFilterSet ordering_fields = ( "name", @@ -166,20 +185,26 @@ class TagViewSet(ModelViewSet): Lower("name"), ) - def get_serializer_class(self): + def get_serializer_class(self, *args, **kwargs): + # from UserPassMixin + kwargs.setdefault("user", self.request.user) if int(self.request.version) == 1: return TagSerializerVersion1 else: return TagSerializer pagination_class = StandardPagination - permission_classes = (IsAuthenticated,) - filter_backends = (DjangoFilterBackend, OrderingFilter) + permission_classes = (IsAuthenticated, PaperlessObjectPermissions) + filter_backends = ( + DjangoFilterBackend, + OrderingFilter, + ObjectOwnedOrGrantedPermissionsFilter, + ) filterset_class = TagFilterSet ordering_fields = ("color", "name", "matching_algorithm", "match", "document_count") -class DocumentTypeViewSet(ModelViewSet): +class DocumentTypeViewSet(ModelViewSet, PassUserMixin): model = DocumentType queryset = DocumentType.objects.annotate( @@ -188,13 +213,18 @@ class DocumentTypeViewSet(ModelViewSet): serializer_class = DocumentTypeSerializer pagination_class = StandardPagination - permission_classes = (IsAuthenticated,) - filter_backends = (DjangoFilterBackend, OrderingFilter) + permission_classes = (IsAuthenticated, PaperlessObjectPermissions) + filter_backends = ( + DjangoFilterBackend, + OrderingFilter, + ObjectOwnedOrGrantedPermissionsFilter, + ) filterset_class = DocumentTypeFilterSet ordering_fields = ("name", "matching_algorithm", "match", "document_count") class DocumentViewSet( + PassUserMixin, RetrieveModelMixin, UpdateModelMixin, DestroyModelMixin, @@ -205,8 +235,13 @@ class DocumentViewSet( queryset = Document.objects.all() serializer_class = DocumentSerializer pagination_class = StandardPagination - permission_classes = (IsAuthenticated,) - filter_backends = (DjangoFilterBackend, SearchFilter, OrderingFilter) + permission_classes = (IsAuthenticated, PaperlessObjectPermissions) + filter_backends = ( + DjangoFilterBackend, + SearchFilter, + OrderingFilter, + ObjectOwnedOrGrantedPermissionsFilter, + ) filterset_class = DocumentFilterSet search_fields = ("title", "correspondent__name", "content") ordering_fields = ( @@ -224,6 +259,7 @@ class DocumentViewSet( return Document.objects.distinct() def get_serializer(self, *args, **kwargs): + super().get_serializer(*args, **kwargs) fields_param = self.request.query_params.get("fields", None) if fields_param: fields = fields_param.split(",") @@ -412,8 +448,8 @@ class DocumentViewSet( "user": { "id": c.user.id, "username": c.user.username, - "firstname": c.user.first_name, - "lastname": c.user.last_name, + "first_name": c.user.first_name, + "last_name": c.user.last_name, }, } for c in Comment.objects.filter(document=doc).order_by("-created") @@ -474,7 +510,7 @@ class DocumentViewSet( ) -class SearchResultSerializer(DocumentSerializer): +class SearchResultSerializer(DocumentSerializer, PassUserMixin): def to_representation(self, instance): doc = Document.objects.get(id=instance["id"]) comments = ",".join( @@ -514,6 +550,12 @@ class UnifiedSearchViewSet(DocumentViewSet): if self._is_search_request(): from documents import index + if hasattr(self.request, "user"): + # pass user to query for perms + self.request.query_params._mutable = True + self.request.query_params["user"] = self.request.user.id + self.request.query_params._mutable = False + if "query" in self.request.query_params: query_class = index.DelayedFullTextQuery elif "more_like_id" in self.request.query_params: @@ -547,7 +589,7 @@ class UnifiedSearchViewSet(DocumentViewSet): class LogViewSet(ViewSet): - permission_classes = (IsAuthenticated,) + permission_classes = (IsAuthenticated, PaperlessAdminPermissions) log_files = ["paperless", "mail"] @@ -569,20 +611,20 @@ class LogViewSet(ViewSet): return Response(self.log_files) -class SavedViewViewSet(ModelViewSet): +class SavedViewViewSet(ModelViewSet, PassUserMixin): model = SavedView queryset = SavedView.objects.all() serializer_class = SavedViewSerializer pagination_class = StandardPagination - permission_classes = (IsAuthenticated,) + permission_classes = (IsAuthenticated, PaperlessObjectPermissions) def get_queryset(self): user = self.request.user - return SavedView.objects.filter(user=user) + return SavedView.objects.filter(owner=user) def perform_create(self, serializer): - serializer.save(user=self.request.user) + serializer.save(owner=self.request.user) class BulkEditView(GenericAPIView): @@ -624,6 +666,7 @@ class PostDocumentView(GenericAPIView): tag_ids = serializer.validated_data.get("tags") title = serializer.validated_data.get("title") created = serializer.validated_data.get("created") + owner_id = serializer.validated_data.get("owner") t = int(mktime(datetime.now().timetuple())) @@ -648,6 +691,7 @@ class PostDocumentView(GenericAPIView): override_tag_ids=tag_ids, task_id=task_id, override_created=created, + override_owner_id=owner_id, ) return Response(async_task.id) @@ -842,7 +886,7 @@ class RemoteVersionView(GenericAPIView): ) -class StoragePathViewSet(ModelViewSet): +class StoragePathViewSet(ModelViewSet, PassUserMixin): model = StoragePath queryset = StoragePath.objects.annotate(document_count=Count("documents")).order_by( @@ -851,7 +895,7 @@ class StoragePathViewSet(ModelViewSet): serializer_class = StoragePathSerializer pagination_class = StandardPagination - permission_classes = (IsAuthenticated,) + permission_classes = (IsAuthenticated, PaperlessObjectPermissions) filter_backends = (DjangoFilterBackend, OrderingFilter) filterset_class = StoragePathFilterSet ordering_fields = ("name", "path", "matching_algorithm", "match", "document_count") @@ -867,9 +911,6 @@ class UiSettingsView(GenericAPIView): serializer.is_valid(raise_exception=True) user = User.objects.get(pk=request.user.id) - displayname = user.username - if user.first_name or user.last_name: - displayname = " ".join([user.first_name, user.last_name]) ui_settings = {} if hasattr(user, "ui_settings"): ui_settings = user.ui_settings.settings @@ -881,12 +922,14 @@ class UiSettingsView(GenericAPIView): ui_settings["update_checking"] = { "backend_setting": settings.ENABLE_UPDATE_CHECK, } + # strip . + roles = map(lambda perm: re.sub(r"^\w+.", "", perm), user.get_all_permissions()) return Response( { "user_id": user.id, "username": user.username, - "display_name": displayname, "settings": ui_settings, + "permissions": roles, }, ) diff --git a/src/paperless/apps.py b/src/paperless/apps.py new file mode 100644 index 000000000..323099745 --- /dev/null +++ b/src/paperless/apps.py @@ -0,0 +1,15 @@ +from django.apps import AppConfig +from django.utils.translation import gettext_lazy as _ +from paperless.signals import handle_failed_login + + +class PaperlessConfig(AppConfig): + name = "paperless" + + verbose_name = _("Paperless") + + def ready(self): + from django.contrib.auth.signals import user_login_failed + + user_login_failed.connect(handle_failed_login) + AppConfig.ready(self) diff --git a/src/paperless/filters.py b/src/paperless/filters.py new file mode 100644 index 000000000..5be7cc2f7 --- /dev/null +++ b/src/paperless/filters.py @@ -0,0 +1,16 @@ +from django.contrib.auth.models import Group +from django.contrib.auth.models import User +from django_filters.rest_framework import FilterSet +from documents.filters import CHAR_KWARGS + + +class UserFilterSet(FilterSet): + class Meta: + model = User + fields = {"username": CHAR_KWARGS} + + +class GroupFilterSet(FilterSet): + class Meta: + model = Group + fields = {"name": CHAR_KWARGS} diff --git a/src/paperless/serialisers.py b/src/paperless/serialisers.py new file mode 100644 index 000000000..63ddb773a --- /dev/null +++ b/src/paperless/serialisers.py @@ -0,0 +1,98 @@ +from django.contrib.auth.models import Group +from django.contrib.auth.models import Permission +from django.contrib.auth.models import User +from rest_framework import serializers + + +class ObfuscatedUserPasswordField(serializers.Field): + """ + Sends *** string instead of password in the clear + """ + + def to_representation(self, value): + return "**********" if len(value) > 0 else "" + + def to_internal_value(self, data): + return data + + +class UserSerializer(serializers.ModelSerializer): + + password = ObfuscatedUserPasswordField(required=False) + user_permissions = serializers.SlugRelatedField( + many=True, + queryset=Permission.objects.all(), + slug_field="codename", + ) + inherited_permissions = serializers.SerializerMethodField() + + class Meta: + model = User + fields = ( + "id", + "username", + "email", + "password", + "first_name", + "last_name", + "date_joined", + "is_staff", + "is_active", + "is_superuser", + "groups", + "user_permissions", + "inherited_permissions", + ) + + def get_inherited_permissions(self, obj): + return obj.get_group_permissions() + + def update(self, instance, validated_data): + if "password" in validated_data: + if len(validated_data.get("password").replace("*", "")) > 0: + instance.set_password(validated_data.get("password")) + instance.save() + validated_data.pop("password") + super().update(instance, validated_data) + return instance + + def create(self, validated_data): + groups = None + if "groups" in validated_data: + groups = validated_data.pop("groups") + user_permissions = None + if "user_permissions" in validated_data: + user_permissions = validated_data.pop("user_permissions") + password = None + if "password" in validated_data: + if len(validated_data.get("password").replace("*", "")) > 0: + password = validated_data.pop("password") + user = User.objects.create(**validated_data) + # set groups + if groups: + user.groups.set(groups) + # set permissions + if user_permissions: + user.user_permissions.set(user_permissions) + # set password + if password: + user.set_password(password) + user.save() + return user + + +class GroupSerializer(serializers.ModelSerializer): + + permissions = serializers.SlugRelatedField( + many=True, + queryset=Permission.objects.all(), + slug_field="codename", + ) + + class Meta: + model = Group + fields = ( + "id", + "name", + "permissions", + ) diff --git a/src/paperless/settings.py b/src/paperless/settings.py index 5cac5e621..41f08f3e2 100644 --- a/src/paperless/settings.py +++ b/src/paperless/settings.py @@ -260,6 +260,7 @@ INSTALLED_APPS = [ "rest_framework.authtoken", "django_filters", "django_celery_results", + "guardian", ] + env_apps if DEBUG: @@ -349,6 +350,11 @@ CHANNEL_LAYERS = { # Security # ############################################################################### +AUTHENTICATION_BACKENDS = [ + "guardian.backends.ObjectPermissionBackend", + "django.contrib.auth.backends.ModelBackend", +] + AUTO_LOGIN_USERNAME = os.getenv("PAPERLESS_AUTO_LOGIN_USERNAME") if AUTO_LOGIN_USERNAME: @@ -365,10 +371,7 @@ HTTP_REMOTE_USER_HEADER_NAME = os.getenv( if ENABLE_HTTP_REMOTE_USER: MIDDLEWARE.append("paperless.auth.HttpRemoteUserMiddleware") - AUTHENTICATION_BACKENDS = [ - "django.contrib.auth.backends.RemoteUserBackend", - "django.contrib.auth.backends.ModelBackend", - ] + AUTHENTICATION_BACKENDS.insert(0, "django.contrib.auth.backends.RemoteUserBackend") REST_FRAMEWORK["DEFAULT_AUTHENTICATION_CLASSES"].append( "rest_framework.authentication.RemoteUserAuthentication", ) @@ -413,6 +416,13 @@ if _paperless_url: # always allow localhost. Necessary e.g. for healthcheck in docker. ALLOWED_HOSTS = [_paperless_uri.hostname] + ["localhost"] +# For use with trusted proxies +_trusted_proxies = os.getenv("PAPERLESS_TRUSTED_PROXIES") +if _trusted_proxies: + TRUSTED_PROXIES = _trusted_proxies.split(",") +else: + TRUSTED_PROXIES = [] + # The secret key has a default that should be fine so long as you're hosting # Paperless on a closed network. However, if you're putting this anywhere # public, you should change the key to something unique and verbose. @@ -673,7 +683,7 @@ CONSUMER_IGNORE_PATTERNS = list( json.loads( os.getenv( "PAPERLESS_CONSUMER_IGNORE_PATTERNS", - '[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini"]', # noqa: E501 + '[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini", "@eaDir/*"]', # noqa: E501 ), ), ) diff --git a/src/paperless/signals.py b/src/paperless/signals.py new file mode 100644 index 000000000..cedad7f67 --- /dev/null +++ b/src/paperless/signals.py @@ -0,0 +1,32 @@ +import logging + +from django.conf import settings +from ipware import get_client_ip + +logger = logging.getLogger("paperless.auth") + + +# https://docs.djangoproject.com/en/4.1/ref/contrib/auth/#django.contrib.auth.signals.user_login_failed +def handle_failed_login(sender, credentials, request, **kwargs): + client_ip, is_routable = get_client_ip( + request, + proxy_trusted_ips=settings.TRUSTED_PROXIES, + ) + if client_ip is None: + logger.info( + f"Login failed for user `{credentials['username']}`." + + " Unable to determine IP address.", + ) + else: + if is_routable: + # We got the client's IP address + logger.info( + f"Login failed for user `{credentials['username']}`" + + f" from IP `{client_ip}.`", + ) + else: + # The client's IP address is private + logger.info( + f"Login failed for user `{credentials['username']}`" + + f" from private IP `{client_ip}.`", + ) diff --git a/src/paperless/tests/test_signals.py b/src/paperless/tests/test_signals.py new file mode 100644 index 000000000..1a4d7892f --- /dev/null +++ b/src/paperless/tests/test_signals.py @@ -0,0 +1,80 @@ +from django.http import HttpRequest +from django.test import TestCase +from paperless.signals import handle_failed_login + + +class TestFailedLoginLogging(TestCase): + def setUp(self): + super().setUp() + + self.creds = { + "username": "john lennon", + } + + def test_none(self): + """ + GIVEN: + - Request with no IP possible + WHEN: + - Request provided to signal handler + THEN: + - Unable to determine logged + """ + request = HttpRequest() + request.META = {} + with self.assertLogs("paperless.auth") as logs: + handle_failed_login(None, self.creds, request) + + self.assertEqual( + logs.output, + [ + "INFO:paperless.auth:Login failed for user `john lennon`. Unable to determine IP address.", + ], + ) + + def test_public(self): + """ + GIVEN: + - Request with publicly routeable IP + WHEN: + - Request provided to signal handler + THEN: + - Expected IP is logged + """ + request = HttpRequest() + request.META = { + "HTTP_X_FORWARDED_FOR": "177.139.233.139", + } + with self.assertLogs("paperless.auth") as logs: + handle_failed_login(None, self.creds, request) + + self.assertEqual( + logs.output, + [ + "INFO:paperless.auth:Login failed for user `john lennon` from IP `177.139.233.139.`", + ], + ) + + def test_private(self): + """ + GIVEN: + - Request with private range IP + WHEN: + - Request provided to signal handler + THEN: + - Expected IP is logged + - IP is noted to be a private IP + """ + request = HttpRequest() + request.META = { + "HTTP_X_FORWARDED_FOR": "10.0.0.1", + } + with self.assertLogs("paperless.auth") as logs: + handle_failed_login(None, self.creds, request) + + self.assertEqual( + logs.output, + [ + "INFO:paperless.auth:Login failed for user `john lennon` from private IP `10.0.0.1.`", + ], + ) diff --git a/src/paperless/urls.py b/src/paperless/urls.py index 490be525a..3c2d955d9 100644 --- a/src/paperless/urls.py +++ b/src/paperless/urls.py @@ -27,6 +27,8 @@ from documents.views import UiSettingsView from documents.views import UnifiedSearchViewSet from paperless.consumers import StatusConsumer from paperless.views import FaviconView +from paperless.views import GroupViewSet +from paperless.views import UserViewSet from paperless_mail.views import MailAccountViewSet from paperless_mail.views import MailRuleViewSet from rest_framework.authtoken import views @@ -41,6 +43,8 @@ api_router.register(r"tags", TagViewSet) api_router.register(r"saved_views", SavedViewViewSet) api_router.register(r"storage_paths", StoragePathViewSet) api_router.register(r"tasks", TasksViewSet, basename="tasks") +api_router.register(r"users", UserViewSet, basename="users") +api_router.register(r"groups", GroupViewSet, basename="groups") api_router.register(r"mail_accounts", MailAccountViewSet) api_router.register(r"mail_rules", MailRuleViewSet) diff --git a/src/paperless/version.py b/src/paperless/version.py index 843ae7616..fe7ecab4d 100644 --- a/src/paperless/version.py +++ b/src/paperless/version.py @@ -1,7 +1,7 @@ from typing import Final from typing import Tuple -__version__: Final[Tuple[int, int, int]] = (1, 12, 2) +__version__: Final[Tuple[int, int, int]] = (1, 13, 0) # Version string like X.Y.Z __full_version_str__: Final[str] = ".".join(map(str, __version__)) # Version string like X.Y diff --git a/src/paperless/views.py b/src/paperless/views.py index 975df6601..00945e5fb 100644 --- a/src/paperless/views.py +++ b/src/paperless/views.py @@ -1,8 +1,20 @@ import os +from django.contrib.auth.models import Group +from django.contrib.auth.models import User +from django.db.models.functions import Lower from django.http import HttpResponse from django.views.generic import View +from django_filters.rest_framework import DjangoFilterBackend +from documents.permissions import PaperlessObjectPermissions +from paperless.filters import GroupFilterSet +from paperless.filters import UserFilterSet +from paperless.serialisers import GroupSerializer +from paperless.serialisers import UserSerializer +from rest_framework.filters import OrderingFilter from rest_framework.pagination import PageNumberPagination +from rest_framework.permissions import IsAuthenticated +from rest_framework.viewsets import ModelViewSet class StandardPagination(PageNumberPagination): @@ -22,3 +34,31 @@ class FaviconView(View): ) with open(favicon, "rb") as f: return HttpResponse(f, content_type="image/x-icon") + + +class UserViewSet(ModelViewSet): + model = User + + queryset = User.objects.exclude( + username__in=["consumer", "AnonymousUser"], + ).order_by(Lower("username")) + + serializer_class = UserSerializer + pagination_class = StandardPagination + permission_classes = (IsAuthenticated, PaperlessObjectPermissions) + filter_backends = (DjangoFilterBackend, OrderingFilter) + filterset_class = UserFilterSet + ordering_fields = ("username",) + + +class GroupViewSet(ModelViewSet): + model = Group + + queryset = Group.objects.order_by(Lower("name")) + + serializer_class = GroupSerializer + pagination_class = StandardPagination + permission_classes = (IsAuthenticated, PaperlessObjectPermissions) + filter_backends = (DjangoFilterBackend, OrderingFilter) + filterset_class = GroupFilterSet + ordering_fields = ("name",) diff --git a/src/paperless_mail/mail.py b/src/paperless_mail/mail.py index ca09bb683..b49d3c3b5 100644 --- a/src/paperless_mail/mail.py +++ b/src/paperless_mail/mail.py @@ -515,6 +515,7 @@ class MailAccountHandler(LoggingMixin): else None, override_document_type_id=doc_type.id if doc_type else None, override_tag_ids=tag_ids, + override_owner_id=rule.owner.id if rule.owner else None, ) consume_tasks.append(consume_task) @@ -592,6 +593,7 @@ class MailAccountHandler(LoggingMixin): override_correspondent_id=correspondent.id if correspondent else None, override_document_type_id=doc_type.id if doc_type else None, override_tag_ids=tag_ids, + override_owner_id=rule.owner.id if rule.owner else None, ) mail_action_task = apply_mail_action.s( diff --git a/src/paperless_mail/migrations/0017_mailaccount_owner_mailrule_owner.py b/src/paperless_mail/migrations/0017_mailaccount_owner_mailrule_owner.py new file mode 100644 index 000000000..5eeccf440 --- /dev/null +++ b/src/paperless_mail/migrations/0017_mailaccount_owner_mailrule_owner.py @@ -0,0 +1,38 @@ +# Generated by Django 4.1.3 on 2022-12-06 04:48 + +from django.conf import settings +from django.db import migrations, models +import django.db.models.deletion + + +class Migration(migrations.Migration): + + dependencies = [ + migrations.swappable_dependency(settings.AUTH_USER_MODEL), + ("paperless_mail", "0016_mailrule_consumption_scope"), + ] + + operations = [ + migrations.AddField( + model_name="mailaccount", + name="owner", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + verbose_name="owner", + ), + ), + migrations.AddField( + model_name="mailrule", + name="owner", + field=models.ForeignKey( + blank=True, + null=True, + on_delete=django.db.models.deletion.SET_NULL, + to=settings.AUTH_USER_MODEL, + verbose_name="owner", + ), + ), + ] diff --git a/src/paperless_mail/models.py b/src/paperless_mail/models.py index a7267cc06..f8a30c3be 100644 --- a/src/paperless_mail/models.py +++ b/src/paperless_mail/models.py @@ -3,7 +3,7 @@ from django.db import models from django.utils.translation import gettext_lazy as _ -class MailAccount(models.Model): +class MailAccount(document_models.ModelWithOwner): class Meta: verbose_name = _("mail account") verbose_name_plural = _("mail accounts") @@ -51,7 +51,7 @@ class MailAccount(models.Model): return self.name -class MailRule(models.Model): +class MailRule(document_models.ModelWithOwner): class Meta: verbose_name = _("mail rule") verbose_name_plural = _("mail rules") diff --git a/src/paperless_mail/serialisers.py b/src/paperless_mail/serialisers.py index 0d15f617c..49d61838a 100644 --- a/src/paperless_mail/serialisers.py +++ b/src/paperless_mail/serialisers.py @@ -1,5 +1,6 @@ from documents.serialisers import CorrespondentField from documents.serialisers import DocumentTypeField +from documents.serialisers import OwnedObjectSerializer from documents.serialisers import TagsField from paperless_mail.models import MailAccount from paperless_mail.models import MailRule @@ -18,7 +19,7 @@ class ObfuscatedPasswordField(serializers.Field): return data -class MailAccountSerializer(serializers.ModelSerializer): +class MailAccountSerializer(OwnedObjectSerializer): password = ObfuscatedPasswordField() class Meta: @@ -42,17 +43,13 @@ class MailAccountSerializer(serializers.ModelSerializer): super().update(instance, validated_data) return instance - def create(self, validated_data): - mail_account = MailAccount.objects.create(**validated_data) - return mail_account - class AccountField(serializers.PrimaryKeyRelatedField): def get_queryset(self): return MailAccount.objects.all().order_by("-id") -class MailRuleSerializer(serializers.ModelSerializer): +class MailRuleSerializer(OwnedObjectSerializer): account = AccountField(required=True) action_parameter = serializers.CharField( allow_null=True, @@ -96,7 +93,7 @@ class MailRuleSerializer(serializers.ModelSerializer): def create(self, validated_data): if "assign_tags" in validated_data: assign_tags = validated_data.pop("assign_tags") - mail_rule = MailRule.objects.create(**validated_data) + mail_rule = super().create(validated_data) if assign_tags: mail_rule.assign_tags.set(assign_tags) return mail_rule diff --git a/src/paperless_mail/tests/samples/html.eml.pdf b/src/paperless_mail/tests/samples/html.eml.pdf index de4aeb038..d2de2cb8e 100644 Binary files a/src/paperless_mail/tests/samples/html.eml.pdf and b/src/paperless_mail/tests/samples/html.eml.pdf differ diff --git a/src/paperless_mail/views.py b/src/paperless_mail/views.py index 45fc4197e..85aee8902 100644 --- a/src/paperless_mail/views.py +++ b/src/paperless_mail/views.py @@ -1,3 +1,4 @@ +from documents.views import PassUserMixin from paperless.views import StandardPagination from paperless_mail.models import MailAccount from paperless_mail.models import MailRule @@ -7,7 +8,7 @@ from rest_framework.permissions import IsAuthenticated from rest_framework.viewsets import ModelViewSet -class MailAccountViewSet(ModelViewSet): +class MailAccountViewSet(ModelViewSet, PassUserMixin): model = MailAccount queryset = MailAccount.objects.all().order_by("pk") @@ -15,27 +16,11 @@ class MailAccountViewSet(ModelViewSet): pagination_class = StandardPagination permission_classes = (IsAuthenticated,) - # TODO: user-scoped - # def get_queryset(self): - # user = self.request.user - # return MailAccount.objects.filter(user=user) - # def perform_create(self, serializer): - # serializer.save(user=self.request.user) - - -class MailRuleViewSet(ModelViewSet): +class MailRuleViewSet(ModelViewSet, PassUserMixin): model = MailRule queryset = MailRule.objects.all().order_by("order") serializer_class = MailRuleSerializer pagination_class = StandardPagination permission_classes = (IsAuthenticated,) - - # TODO: user-scoped - # def get_queryset(self): - # user = self.request.user - # return MailRule.objects.filter(user=user) - - # def perform_create(self, serializer): - # serializer.save(user=self.request.user)
      Title
      {{doc.created_date | customDate}} {{doc.title | documentTitle}}
      - - + + +