Merge branch 'dev' into feature-pw-removal-workflow-action

Added a test for the remove_password function to ensure it deletes the original document when specified.

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.html

@@ -430,6 +430,24 @@
           </div>
         </div>
       }
+      @case (WorkflowActionType.PasswordRemoval) {
+        <div class="row">
+          <div class="col">
+            <p class="small" i18n>
+              One or more passwords separated by commas or new lines. The workflow will try them in order until one succeeds.
+            </p>
+            <pngx-input-textarea
+              i18n-title
+              title="Passwords"
+              formControlName="passwords"
+              rows="4"
+              [error]="error?.actions?.[i]?.passwords"
+              hint="Passwords are stored in plain text. Use with caution."
+              i18n-hint
+            ></pngx-input-textarea>
+          </div>
+        </div>
+      }
     }
   </div>
 </ng-template>

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.spec.ts

@@ -414,9 +414,6 @@ describe('WorkflowEditDialogComponent', () => {
       return newFilter
     }
 
-    const correspondentAny = addFilterOfType(TriggerFilterType.CorrespondentAny)
-    correspondentAny.get('values').setValue([11])
-
     const correspondentIs = addFilterOfType(TriggerFilterType.CorrespondentIs)
     correspondentIs.get('values').setValue(1)
 
@@ -426,18 +423,12 @@ describe('WorkflowEditDialogComponent', () => {
     const documentTypeIs = addFilterOfType(TriggerFilterType.DocumentTypeIs)
     documentTypeIs.get('values').setValue(1)
 
-    const documentTypeAny = addFilterOfType(TriggerFilterType.DocumentTypeAny)
-    documentTypeAny.get('values').setValue([12])
-
     const documentTypeNot = addFilterOfType(TriggerFilterType.DocumentTypeNot)
     documentTypeNot.get('values').setValue([1])
 
     const storagePathIs = addFilterOfType(TriggerFilterType.StoragePathIs)
     storagePathIs.get('values').setValue(1)
 
-    const storagePathAny = addFilterOfType(TriggerFilterType.StoragePathAny)
-    storagePathAny.get('values').setValue([13])
-
     const storagePathNot = addFilterOfType(TriggerFilterType.StoragePathNot)
     storagePathNot.get('values').setValue([1])
 
@@ -452,13 +443,10 @@ describe('WorkflowEditDialogComponent', () => {
     expect(formValues.triggers[0].filter_has_tags).toEqual([1])
     expect(formValues.triggers[0].filter_has_all_tags).toEqual([2, 3])
     expect(formValues.triggers[0].filter_has_not_tags).toEqual([4])
-    expect(formValues.triggers[0].filter_has_any_correspondents).toEqual([11])
     expect(formValues.triggers[0].filter_has_correspondent).toEqual(1)
     expect(formValues.triggers[0].filter_has_not_correspondents).toEqual([1])
-    expect(formValues.triggers[0].filter_has_any_document_types).toEqual([12])
     expect(formValues.triggers[0].filter_has_document_type).toEqual(1)
     expect(formValues.triggers[0].filter_has_not_document_types).toEqual([1])
-    expect(formValues.triggers[0].filter_has_any_storage_paths).toEqual([13])
     expect(formValues.triggers[0].filter_has_storage_path).toEqual(1)
     expect(formValues.triggers[0].filter_has_not_storage_paths).toEqual([1])
     expect(formValues.triggers[0].filter_custom_field_query).toEqual(
@@ -521,22 +509,16 @@ describe('WorkflowEditDialogComponent', () => {
 
     setFilter(TriggerFilterType.TagsAll, 11)
     setFilter(TriggerFilterType.TagsNone, 12)
-    setFilter(TriggerFilterType.CorrespondentAny, 16)
     setFilter(TriggerFilterType.CorrespondentNot, 13)
-    setFilter(TriggerFilterType.DocumentTypeAny, 17)
     setFilter(TriggerFilterType.DocumentTypeNot, 14)
-    setFilter(TriggerFilterType.StoragePathAny, 18)
     setFilter(TriggerFilterType.StoragePathNot, 15)
 
     const formValues = component['getFormValues']()
 
     expect(formValues.triggers[0].filter_has_all_tags).toEqual([11])
     expect(formValues.triggers[0].filter_has_not_tags).toEqual([12])
-    expect(formValues.triggers[0].filter_has_any_correspondents).toEqual([16])
     expect(formValues.triggers[0].filter_has_not_correspondents).toEqual([13])
-    expect(formValues.triggers[0].filter_has_any_document_types).toEqual([17])
     expect(formValues.triggers[0].filter_has_not_document_types).toEqual([14])
-    expect(formValues.triggers[0].filter_has_any_storage_paths).toEqual([18])
     expect(formValues.triggers[0].filter_has_not_storage_paths).toEqual([15])
   })
 
@@ -660,11 +642,8 @@ describe('WorkflowEditDialogComponent', () => {
       filter_has_tags: [],
       filter_has_all_tags: [],
       filter_has_not_tags: [],
-      filter_has_any_correspondents: [],
       filter_has_not_correspondents: [],
-      filter_has_any_document_types: [],
       filter_has_not_document_types: [],
-      filter_has_any_storage_paths: [],
       filter_has_not_storage_paths: [],
       filter_has_correspondent: null,
       filter_has_document_type: null,
@@ -722,14 +701,11 @@ describe('WorkflowEditDialogComponent', () => {
     trigger.filter_has_tags = [1]
     trigger.filter_has_all_tags = [2, 3]
     trigger.filter_has_not_tags = [4]
-    trigger.filter_has_any_correspondents = [10] as any
     trigger.filter_has_correspondent = 5 as any
     trigger.filter_has_not_correspondents = [6] as any
     trigger.filter_has_document_type = 7 as any
-    trigger.filter_has_any_document_types = [11] as any
     trigger.filter_has_not_document_types = [8] as any
     trigger.filter_has_storage_path = 9 as any
-    trigger.filter_has_any_storage_paths = [12] as any
     trigger.filter_has_not_storage_paths = [10] as any
     trigger.filter_custom_field_query = JSON.stringify([
       'AND',
@@ -740,8 +716,8 @@ describe('WorkflowEditDialogComponent', () => {
     component.ngOnInit()
     const triggerGroup = component.triggerFields.at(0) as FormGroup
     const filters = component.getFiltersFormArray(triggerGroup)
-    expect(filters.length).toBe(13)
-    const customFieldFilter = filters.at(12) as FormGroup
+    expect(filters.length).toBe(10)
+    const customFieldFilter = filters.at(9) as FormGroup
     expect(customFieldFilter.get('type').value).toBe(
       TriggerFilterType.CustomFieldQuery
     )
@@ -750,27 +726,12 @@ describe('WorkflowEditDialogComponent', () => {
   })
 
   it('should expose select metadata helpers', () => {
-    expect(component.isSelectMultiple(TriggerFilterType.CorrespondentAny)).toBe(
-      true
-    )
     expect(component.isSelectMultiple(TriggerFilterType.CorrespondentNot)).toBe(
       true
     )
     expect(component.isSelectMultiple(TriggerFilterType.CorrespondentIs)).toBe(
       false
     )
-    expect(component.isSelectMultiple(TriggerFilterType.DocumentTypeAny)).toBe(
-      true
-    )
-    expect(component.isSelectMultiple(TriggerFilterType.DocumentTypeIs)).toBe(
-      false
-    )
-    expect(component.isSelectMultiple(TriggerFilterType.StoragePathAny)).toBe(
-      true
-    )
-    expect(component.isSelectMultiple(TriggerFilterType.StoragePathIs)).toBe(
-      false
-    )
 
     component.correspondents = [{ id: 1, name: 'C1' } as any]
     component.documentTypes = [{ id: 2, name: 'DT' } as any]
@@ -782,15 +743,9 @@ describe('WorkflowEditDialogComponent', () => {
     expect(
       component.getFilterSelectItems(TriggerFilterType.DocumentTypeIs)
     ).toEqual(component.documentTypes)
-    expect(
-      component.getFilterSelectItems(TriggerFilterType.DocumentTypeAny)
-    ).toEqual(component.documentTypes)
     expect(
       component.getFilterSelectItems(TriggerFilterType.StoragePathIs)
     ).toEqual(component.storagePaths)
-    expect(
-      component.getFilterSelectItems(TriggerFilterType.StoragePathAny)
-    ).toEqual(component.storagePaths)
     expect(component.getFilterSelectItems(TriggerFilterType.TagsAll)).toEqual(
       []
     )

src-ui/src/app/components/common/edit-dialog/workflow-edit-dialog/workflow-edit-dialog.component.ts

@@ -139,19 +139,20 @@ export const WORKFLOW_ACTION_OPTIONS = [
     id: WorkflowActionType.Webhook,
     name: $localize`Webhook`,
   },
+  {
+    id: WorkflowActionType.PasswordRemoval,
+    name: $localize`Password removal`,
+  },
 ]
 
 export enum TriggerFilterType {
   TagsAny = 'tags_any',
   TagsAll = 'tags_all',
   TagsNone = 'tags_none',
-  CorrespondentAny = 'correspondent_any',
   CorrespondentIs = 'correspondent_is',
   CorrespondentNot = 'correspondent_not',
-  DocumentTypeAny = 'document_type_any',
   DocumentTypeIs = 'document_type_is',
   DocumentTypeNot = 'document_type_not',
-  StoragePathAny = 'storage_path_any',
   StoragePathIs = 'storage_path_is',
   StoragePathNot = 'storage_path_not',
   CustomFieldQuery = 'custom_field_query',
@@ -175,11 +176,8 @@ type TriggerFilterAggregate = {
   filter_has_tags: number[]
   filter_has_all_tags: number[]
   filter_has_not_tags: number[]
-  filter_has_any_correspondents: number[]
   filter_has_not_correspondents: number[]
-  filter_has_any_document_types: number[]
   filter_has_not_document_types: number[]
-  filter_has_any_storage_paths: number[]
   filter_has_not_storage_paths: number[]
   filter_has_correspondent: number | null
   filter_has_document_type: number | null
@@ -225,14 +223,6 @@ const TRIGGER_FILTER_DEFINITIONS: TriggerFilterDefinition[] = [
     allowMultipleEntries: false,
     allowMultipleValues: true,
   },
-  {
-    id: TriggerFilterType.CorrespondentAny,
-    name: $localize`Has any of these correspondents`,
-    inputType: 'select',
-    allowMultipleEntries: false,
-    allowMultipleValues: true,
-    selectItems: 'correspondents',
-  },
   {
     id: TriggerFilterType.CorrespondentIs,
     name: $localize`Has correspondent`,
@@ -257,14 +247,6 @@ const TRIGGER_FILTER_DEFINITIONS: TriggerFilterDefinition[] = [
     allowMultipleValues: false,
     selectItems: 'documentTypes',
   },
-  {
-    id: TriggerFilterType.DocumentTypeAny,
-    name: $localize`Has any of these document types`,
-    inputType: 'select',
-    allowMultipleEntries: false,
-    allowMultipleValues: true,
-    selectItems: 'documentTypes',
-  },
   {
     id: TriggerFilterType.DocumentTypeNot,
     name: $localize`Does not have document types`,
@@ -281,14 +263,6 @@ const TRIGGER_FILTER_DEFINITIONS: TriggerFilterDefinition[] = [
     allowMultipleValues: false,
     selectItems: 'storagePaths',
   },
-  {
-    id: TriggerFilterType.StoragePathAny,
-    name: $localize`Has any of these storage paths`,
-    inputType: 'select',
-    allowMultipleEntries: false,
-    allowMultipleValues: true,
-    selectItems: 'storagePaths',
-  },
   {
     id: TriggerFilterType.StoragePathNot,
     name: $localize`Does not have storage paths`,
@@ -336,15 +310,6 @@ const FILTER_HANDLERS: Record<TriggerFilterType, FilterHandler> = {
     extract: (trigger) => trigger.filter_has_not_tags,
     hasValue: (value) => Array.isArray(value) && value.length > 0,
   },
-  [TriggerFilterType.CorrespondentAny]: {
-    apply: (aggregate, values) => {
-      aggregate.filter_has_any_correspondents = Array.isArray(values)
-        ? [...values]
-        : [values]
-    },
-    extract: (trigger) => trigger.filter_has_any_correspondents,
-    hasValue: (value) => Array.isArray(value) && value.length > 0,
-  },
   [TriggerFilterType.CorrespondentIs]: {
     apply: (aggregate, values) => {
       aggregate.filter_has_correspondent = Array.isArray(values)
@@ -372,15 +337,6 @@ const FILTER_HANDLERS: Record<TriggerFilterType, FilterHandler> = {
     extract: (trigger) => trigger.filter_has_document_type,
     hasValue: (value) => value !== null && value !== undefined,
   },
-  [TriggerFilterType.DocumentTypeAny]: {
-    apply: (aggregate, values) => {
-      aggregate.filter_has_any_document_types = Array.isArray(values)
-        ? [...values]
-        : [values]
-    },
-    extract: (trigger) => trigger.filter_has_any_document_types,
-    hasValue: (value) => Array.isArray(value) && value.length > 0,
-  },
   [TriggerFilterType.DocumentTypeNot]: {
     apply: (aggregate, values) => {
       aggregate.filter_has_not_document_types = Array.isArray(values)
@@ -399,15 +355,6 @@ const FILTER_HANDLERS: Record<TriggerFilterType, FilterHandler> = {
     extract: (trigger) => trigger.filter_has_storage_path,
     hasValue: (value) => value !== null && value !== undefined,
   },
-  [TriggerFilterType.StoragePathAny]: {
-    apply: (aggregate, values) => {
-      aggregate.filter_has_any_storage_paths = Array.isArray(values)
-        ? [...values]
-        : [values]
-    },
-    extract: (trigger) => trigger.filter_has_any_storage_paths,
-    hasValue: (value) => Array.isArray(value) && value.length > 0,
-  },
   [TriggerFilterType.StoragePathNot]: {
     apply: (aggregate, values) => {
       aggregate.filter_has_not_storage_paths = Array.isArray(values)
@@ -699,11 +646,8 @@ export class WorkflowEditDialogComponent
             filter_has_tags: [],
             filter_has_all_tags: [],
             filter_has_not_tags: [],
-            filter_has_any_correspondents: [],
             filter_has_not_correspondents: [],
-            filter_has_any_document_types: [],
             filter_has_not_document_types: [],
-            filter_has_any_storage_paths: [],
             filter_has_not_storage_paths: [],
             filter_has_correspondent: null,
             filter_has_document_type: null,
@@ -730,16 +674,10 @@ export class WorkflowEditDialogComponent
           trigger.filter_has_tags = aggregate.filter_has_tags
           trigger.filter_has_all_tags = aggregate.filter_has_all_tags
           trigger.filter_has_not_tags = aggregate.filter_has_not_tags
-          trigger.filter_has_any_correspondents =
-            aggregate.filter_has_any_correspondents
           trigger.filter_has_not_correspondents =
             aggregate.filter_has_not_correspondents
-          trigger.filter_has_any_document_types =
-            aggregate.filter_has_any_document_types
           trigger.filter_has_not_document_types =
             aggregate.filter_has_not_document_types
-          trigger.filter_has_any_storage_paths =
-            aggregate.filter_has_any_storage_paths
           trigger.filter_has_not_storage_paths =
             aggregate.filter_has_not_storage_paths
           trigger.filter_has_correspondent =
@@ -922,11 +860,8 @@ export class WorkflowEditDialogComponent
       case TriggerFilterType.TagsAny:
       case TriggerFilterType.TagsAll:
       case TriggerFilterType.TagsNone:
-      case TriggerFilterType.CorrespondentAny:
       case TriggerFilterType.CorrespondentNot:
-      case TriggerFilterType.DocumentTypeAny:
       case TriggerFilterType.DocumentTypeNot:
-      case TriggerFilterType.StoragePathAny:
       case TriggerFilterType.StoragePathNot:
         return true
       default:
@@ -1202,6 +1137,7 @@ export class WorkflowEditDialogComponent
           headers: new FormControl(action.webhook?.headers),
           include_document: new FormControl(!!action.webhook?.include_document),
         }),
+        passwords: new FormControl(action.passwords),
       }),
       { emitEvent }
     )
@@ -1248,11 +1184,8 @@ export class WorkflowEditDialogComponent
       filter_has_tags: [],
       filter_has_all_tags: [],
       filter_has_not_tags: [],
-      filter_has_any_correspondents: [],
       filter_has_not_correspondents: [],
-      filter_has_any_document_types: [],
       filter_has_not_document_types: [],
-      filter_has_any_storage_paths: [],
       filter_has_not_storage_paths: [],
       filter_custom_field_query: null,
       filter_has_correspondent: null,

src-ui/src/app/components/document-detail/document-detail.component.ts

@@ -176,6 +176,7 @@ export enum ZoomSetting {
     NgxBootstrapIconsModule,
     PdfViewerModule,
     TextAreaComponent,
+    PasswordRemovalConfirmDialogComponent,
   ],
 })
 export class DocumentDetailComponent

src-ui/src/app/data/workflow-action.ts

@@ -5,6 +5,7 @@ export enum WorkflowActionType {
   Removal = 2,
   Email = 3,
   Webhook = 4,
+  PasswordRemoval = 5,
 }
 
 export interface WorkflowActionEmail extends ObjectWithId {
@@ -97,4 +98,6 @@ export interface WorkflowAction extends ObjectWithId {
   email?: WorkflowActionEmail
 
   webhook?: WorkflowActionWebhook
+
+  passwords?: string
 }

src-ui/src/app/data/workflow-trigger.ts

@@ -44,16 +44,10 @@ export interface WorkflowTrigger extends ObjectWithId {
 
   filter_has_not_tags?: number[] // Tag.id[]
 
-  filter_has_any_correspondents?: number[] // Correspondent.id[]
-
   filter_has_not_correspondents?: number[] // Correspondent.id[]
 
-  filter_has_any_document_types?: number[] // DocumentType.id[]
-
   filter_has_not_document_types?: number[] // DocumentType.id[]
 
-  filter_has_any_storage_paths?: number[] // StoragePath.id[]
-
   filter_has_not_storage_paths?: number[] // StoragePath.id[]
 
   filter_custom_field_query?: string

src/documents/matching.py

@@ -403,18 +403,6 @@ def existing_document_matches_workflow(
                 f"Document tags {list(document.tags.all())} include excluded tags {list(trigger_has_not_tags_qs)}",
             )
 
-    allowed_correspondent_ids = set(
-        trigger.filter_has_any_correspondents.values_list("id", flat=True),
-    )
-    if (
-        allowed_correspondent_ids
-        and document.correspondent_id not in allowed_correspondent_ids
-    ):
-        return (
-            False,
-            f"Document correspondent {document.correspondent} is not one of {list(trigger.filter_has_any_correspondents.all())}",
-        )
-
     # Document correspondent vs trigger has_correspondent
     if (
         trigger.filter_has_correspondent_id is not None
@@ -436,17 +424,6 @@ def existing_document_matches_workflow(
             f"Document correspondent {document.correspondent} is excluded by {list(trigger.filter_has_not_correspondents.all())}",
         )
 
-    allowed_document_type_ids = set(
-        trigger.filter_has_any_document_types.values_list("id", flat=True),
-    )
-    if allowed_document_type_ids and (
-        document.document_type_id not in allowed_document_type_ids
-    ):
-        return (
-            False,
-            f"Document doc type {document.document_type} is not one of {list(trigger.filter_has_any_document_types.all())}",
-        )
-
     # Document document_type vs trigger has_document_type
     if (
         trigger.filter_has_document_type_id is not None
@@ -468,17 +445,6 @@ def existing_document_matches_workflow(
             f"Document doc type {document.document_type} is excluded by {list(trigger.filter_has_not_document_types.all())}",
         )
 
-    allowed_storage_path_ids = set(
-        trigger.filter_has_any_storage_paths.values_list("id", flat=True),
-    )
-    if allowed_storage_path_ids and (
-        document.storage_path_id not in allowed_storage_path_ids
-    ):
-        return (
-            False,
-            f"Document storage path {document.storage_path} is not one of {list(trigger.filter_has_any_storage_paths.all())}",
-        )
-
     # Document storage_path vs trigger has_storage_path
     if (
         trigger.filter_has_storage_path_id is not None
@@ -566,10 +532,6 @@ def prefilter_documents_by_workflowtrigger(
 
     # Correspondent, DocumentType, etc. filtering
 
-    if trigger.filter_has_any_correspondents.exists():
-        documents = documents.filter(
-            correspondent__in=trigger.filter_has_any_correspondents.all(),
-        )
     if trigger.filter_has_correspondent is not None:
         documents = documents.filter(
             correspondent=trigger.filter_has_correspondent,
@@ -579,10 +541,6 @@ def prefilter_documents_by_workflowtrigger(
             correspondent__in=trigger.filter_has_not_correspondents.all(),
         )
 
-    if trigger.filter_has_any_document_types.exists():
-        documents = documents.filter(
-            document_type__in=trigger.filter_has_any_document_types.all(),
-        )
     if trigger.filter_has_document_type is not None:
         documents = documents.filter(
             document_type=trigger.filter_has_document_type,
@@ -592,10 +550,6 @@ def prefilter_documents_by_workflowtrigger(
             document_type__in=trigger.filter_has_not_document_types.all(),
         )
 
-    if trigger.filter_has_any_storage_paths.exists():
-        documents = documents.filter(
-            storage_path__in=trigger.filter_has_any_storage_paths.all(),
-        )
     if trigger.filter_has_storage_path is not None:
         documents = documents.filter(
             storage_path=trigger.filter_has_storage_path,
@@ -650,11 +604,8 @@ def document_matches_workflow(
             "filter_has_tags",
             "filter_has_all_tags",
             "filter_has_not_tags",
-            "filter_has_any_document_types",
             "filter_has_not_document_types",
-            "filter_has_any_correspondents",
             "filter_has_not_correspondents",
-            "filter_has_any_storage_paths",
             "filter_has_not_storage_paths",
         )
     )

src/documents/migrations/1075_workflowaction_passwords_alter_workflowaction_type.py

@@ -0,0 +1,38 @@
+# Generated by Django 5.2.7 on 2025-12-29 03:56
+
+from django.db import migrations
+from django.db import models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("documents", "1074_workflowrun_deleted_at_workflowrun_restored_at_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="workflowaction",
+            name="passwords",
+            field=models.TextField(
+                blank=True,
+                help_text="Passwords to try when removing PDF protection. Separate with commas or new lines.",
+                null=True,
+                verbose_name="passwords",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="workflowaction",
+            name="type",
+            field=models.PositiveIntegerField(
+                choices=[
+                    (1, "Assignment"),
+                    (2, "Removal"),
+                    (3, "Email"),
+                    (4, "Webhook"),
+                    (5, "Password removal"),
+                ],
+                default=1,
+                verbose_name="Workflow Action Type",
+            ),
+        ),
+    ]

src/documents/migrations/1075_workflowtrigger_filter_has_any_correspondents_and_more.py

@@ -1,43 +0,0 @@
-# Generated by Django 5.2.7 on 2025-12-17 22:25
-
-from django.db import migrations
-from django.db import models
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("documents", "1074_workflowrun_deleted_at_workflowrun_restored_at_and_more"),
-    ]
-
-    operations = [
-        migrations.AddField(
-            model_name="workflowtrigger",
-            name="filter_has_any_correspondents",
-            field=models.ManyToManyField(
-                blank=True,
-                related_name="workflowtriggers_has_any_correspondent",
-                to="documents.correspondent",
-                verbose_name="has one of these correspondents",
-            ),
-        ),
-        migrations.AddField(
-            model_name="workflowtrigger",
-            name="filter_has_any_document_types",
-            field=models.ManyToManyField(
-                blank=True,
-                related_name="workflowtriggers_has_any_document_type",
-                to="documents.documenttype",
-                verbose_name="has one of these document types",
-            ),
-        ),
-        migrations.AddField(
-            model_name="workflowtrigger",
-            name="filter_has_any_storage_paths",
-            field=models.ManyToManyField(
-                blank=True,
-                related_name="workflowtriggers_has_any_storage_path",
-                to="documents.storagepath",
-                verbose_name="has one of these storage paths",
-            ),
-        ),
-    ]

src/documents/models.py

@@ -1087,13 +1087,6 @@ class WorkflowTrigger(models.Model):
         verbose_name=_("has this document type"),
     )
 
-    filter_has_any_document_types = models.ManyToManyField(
-        DocumentType,
-        blank=True,
-        related_name="workflowtriggers_has_any_document_type",
-        verbose_name=_("has one of these document types"),
-    )
-
     filter_has_not_document_types = models.ManyToManyField(
         DocumentType,
         blank=True,
@@ -1116,13 +1109,6 @@ class WorkflowTrigger(models.Model):
         verbose_name=_("does not have these correspondent(s)"),
     )
 
-    filter_has_any_correspondents = models.ManyToManyField(
-        Correspondent,
-        blank=True,
-        related_name="workflowtriggers_has_any_correspondent",
-        verbose_name=_("has one of these correspondents"),
-    )
-
     filter_has_storage_path = models.ForeignKey(
         StoragePath,
         null=True,
@@ -1131,13 +1117,6 @@ class WorkflowTrigger(models.Model):
         verbose_name=_("has this storage path"),
     )
 
-    filter_has_any_storage_paths = models.ManyToManyField(
-        StoragePath,
-        blank=True,
-        related_name="workflowtriggers_has_any_storage_path",
-        verbose_name=_("has one of these storage paths"),
-    )
-
     filter_has_not_storage_paths = models.ManyToManyField(
         StoragePath,
         blank=True,
@@ -1308,6 +1287,10 @@ class WorkflowAction(models.Model):
             4,
             _("Webhook"),
         )
+        PASSWORD_REMOVAL = (
+            5,
+            _("Password removal"),
+        )
 
     type = models.PositiveIntegerField(
         _("Workflow Action Type"),
@@ -1535,6 +1518,15 @@ class WorkflowAction(models.Model):
         verbose_name=_("webhook"),
     )
 
+    passwords = models.TextField(
+        _("passwords"),
+        null=True,
+        blank=True,
+        help_text=_(
+            "Passwords to try when removing PDF protection. Separate with commas or new lines.",
+        ),
+    )
+
     class Meta:
         verbose_name = _("workflow action")
         verbose_name_plural = _("workflow actions")

src/documents/serialisers.py

@@ -2295,11 +2295,8 @@ class WorkflowTriggerSerializer(serializers.ModelSerializer):
             "filter_has_all_tags",
             "filter_has_not_tags",
             "filter_custom_field_query",
-            "filter_has_any_correspondents",
             "filter_has_not_correspondents",
-            "filter_has_any_document_types",
             "filter_has_not_document_types",
-            "filter_has_any_storage_paths",
             "filter_has_not_storage_paths",
             "filter_has_correspondent",
             "filter_has_document_type",
@@ -2452,6 +2449,7 @@ class WorkflowActionSerializer(serializers.ModelSerializer):
             "remove_change_groups",
             "email",
             "webhook",
+            "passwords",
         ]
 
     def validate(self, attrs):
@@ -2508,6 +2506,20 @@ class WorkflowActionSerializer(serializers.ModelSerializer):
                 "Webhook data is required for webhook actions",
             )
 
+        if (
+            "type" in attrs
+            and attrs["type"] == WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL
+        ):
+            passwords = attrs.get("passwords")
+            if passwords is None or not isinstance(passwords, str):
+                raise serializers.ValidationError(
+                    "Passwords are required for password removal actions",
+                )
+            if not passwords.strip():
+                raise serializers.ValidationError(
+                    "Passwords are required for password removal actions",
+                )
+
         return attrs
 
 
@@ -2537,26 +2549,14 @@ class WorkflowSerializer(serializers.ModelSerializer):
                 filter_has_tags = trigger.pop("filter_has_tags", None)
                 filter_has_all_tags = trigger.pop("filter_has_all_tags", None)
                 filter_has_not_tags = trigger.pop("filter_has_not_tags", None)
-                filter_has_any_correspondents = trigger.pop(
-                    "filter_has_any_correspondents",
-                    None,
-                )
                 filter_has_not_correspondents = trigger.pop(
                     "filter_has_not_correspondents",
                     None,
                 )
-                filter_has_any_document_types = trigger.pop(
-                    "filter_has_any_document_types",
-                    None,
-                )
                 filter_has_not_document_types = trigger.pop(
                     "filter_has_not_document_types",
                     None,
                 )
-                filter_has_any_storage_paths = trigger.pop(
-                    "filter_has_any_storage_paths",
-                    None,
-                )
                 filter_has_not_storage_paths = trigger.pop(
                     "filter_has_not_storage_paths",
                     None,
@@ -2573,26 +2573,14 @@ class WorkflowSerializer(serializers.ModelSerializer):
                     trigger_instance.filter_has_all_tags.set(filter_has_all_tags)
                 if filter_has_not_tags is not None:
                     trigger_instance.filter_has_not_tags.set(filter_has_not_tags)
-                if filter_has_any_correspondents is not None:
-                    trigger_instance.filter_has_any_correspondents.set(
-                        filter_has_any_correspondents,
-                    )
                 if filter_has_not_correspondents is not None:
                     trigger_instance.filter_has_not_correspondents.set(
                         filter_has_not_correspondents,
                     )
-                if filter_has_any_document_types is not None:
-                    trigger_instance.filter_has_any_document_types.set(
-                        filter_has_any_document_types,
-                    )
                 if filter_has_not_document_types is not None:
                     trigger_instance.filter_has_not_document_types.set(
                         filter_has_not_document_types,
                     )
-                if filter_has_any_storage_paths is not None:
-                    trigger_instance.filter_has_any_storage_paths.set(
-                        filter_has_any_storage_paths,
-                    )
                 if filter_has_not_storage_paths is not None:
                     trigger_instance.filter_has_not_storage_paths.set(
                         filter_has_not_storage_paths,

src/documents/signals/handlers.py

@@ -46,6 +46,7 @@ from documents.permissions import get_objects_for_user_owner_aware
 from documents.templating.utils import convert_format_str_to_template_format
 from documents.workflows.actions import build_workflow_action_context
 from documents.workflows.actions import execute_email_action
+from documents.workflows.actions import execute_password_removal_action
 from documents.workflows.actions import execute_webhook_action
 from documents.workflows.mutations import apply_assignment_to_document
 from documents.workflows.mutations import apply_assignment_to_overrides
@@ -792,6 +793,8 @@ def run_workflows(
                         logging_group,
                         original_file,
                     )
+                elif action.type == WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL:
+                    execute_password_removal_action(action, document, logging_group)
 
             if not use_overrides:
                 # limit title to 128 characters

src/documents/tests/test_api_workflows.py

@@ -186,11 +186,8 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
                             "filter_has_tags": [self.t1.id],
                             "filter_has_all_tags": [self.t2.id],
                             "filter_has_not_tags": [self.t3.id],
-                            "filter_has_any_correspondents": [self.c.id],
                             "filter_has_not_correspondents": [self.c2.id],
-                            "filter_has_any_document_types": [self.dt.id],
                             "filter_has_not_document_types": [self.dt2.id],
-                            "filter_has_any_storage_paths": [self.sp.id],
                             "filter_has_not_storage_paths": [self.sp2.id],
                             "filter_custom_field_query": json.dumps(
                                 [
@@ -251,26 +248,14 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
             set(trigger.filter_has_not_tags.values_list("id", flat=True)),
             {self.t3.id},
         )
-        self.assertSetEqual(
-            set(trigger.filter_has_any_correspondents.values_list("id", flat=True)),
-            {self.c.id},
-        )
         self.assertSetEqual(
             set(trigger.filter_has_not_correspondents.values_list("id", flat=True)),
             {self.c2.id},
         )
-        self.assertSetEqual(
-            set(trigger.filter_has_any_document_types.values_list("id", flat=True)),
-            {self.dt.id},
-        )
         self.assertSetEqual(
             set(trigger.filter_has_not_document_types.values_list("id", flat=True)),
             {self.dt2.id},
         )
-        self.assertSetEqual(
-            set(trigger.filter_has_any_storage_paths.values_list("id", flat=True)),
-            {self.sp.id},
-        )
         self.assertSetEqual(
             set(trigger.filter_has_not_storage_paths.values_list("id", flat=True)),
             {self.sp2.id},
@@ -434,11 +419,8 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
                             "filter_has_tags": [self.t1.id],
                             "filter_has_all_tags": [self.t2.id],
                             "filter_has_not_tags": [self.t3.id],
-                            "filter_has_any_correspondents": [self.c.id],
                             "filter_has_not_correspondents": [self.c2.id],
-                            "filter_has_any_document_types": [self.dt.id],
                             "filter_has_not_document_types": [self.dt2.id],
-                            "filter_has_any_storage_paths": [self.sp.id],
                             "filter_has_not_storage_paths": [self.sp2.id],
                             "filter_custom_field_query": json.dumps(
                                 ["AND", [[self.cf1.id, "exact", "value"]]],
@@ -468,26 +450,14 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
             workflow.triggers.first().filter_has_not_tags.first(),
             self.t3,
         )
-        self.assertEqual(
-            workflow.triggers.first().filter_has_any_correspondents.first(),
-            self.c,
-        )
         self.assertEqual(
             workflow.triggers.first().filter_has_not_correspondents.first(),
             self.c2,
         )
-        self.assertEqual(
-            workflow.triggers.first().filter_has_any_document_types.first(),
-            self.dt,
-        )
         self.assertEqual(
             workflow.triggers.first().filter_has_not_document_types.first(),
             self.dt2,
         )
-        self.assertEqual(
-            workflow.triggers.first().filter_has_any_storage_paths.first(),
-            self.sp,
-        )
         self.assertEqual(
             workflow.triggers.first().filter_has_not_storage_paths.first(),
             self.sp2,
@@ -838,3 +808,57 @@ class TestApiWorkflows(DirectoriesMixin, APITestCase):
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         self.action.refresh_from_db()
         self.assertEqual(self.action.assign_title, "Patched Title")
+
+    def test_password_action_passwords_field(self):
+        """
+        GIVEN:
+            - Nothing
+        WHEN:
+            - A workflow password removal action is created with passwords set
+        THEN:
+            - The passwords field is correctly stored and retrieved
+        """
+        passwords = "password1,password2\npassword3"
+        response = self.client.post(
+            "/api/workflow_actions/",
+            {
+                "type": WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL,
+                "passwords": passwords,
+            },
+        )
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+        self.assertEqual(response.data["passwords"], passwords)
+
+    def test_password_action_no_passwords_field(self):
+        """
+        GIVEN:
+            - Nothing
+        WHEN:
+            - A workflow password removal action is created with no passwords set
+            - A workflow password removal action is created with passwords set to empty string
+        THEN:
+            - The required validation error is raised
+        """
+        response = self.client.post(
+            "/api/workflow_actions/",
+            {
+                "type": WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL,
+            },
+        )
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn(
+            "Passwords are required",
+            str(response.data["non_field_errors"][0]),
+        )
+        response = self.client.post(
+            "/api/workflow_actions/",
+            {
+                "type": WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL,
+                "passwords": "",
+            },
+        )
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertIn(
+            "Passwords are required",
+            str(response.data["non_field_errors"][0]),
+        )

src/documents/tests/test_workflows.py

@@ -2,6 +2,7 @@ import datetime
 import json
 import shutil
 import socket
+import tempfile
 from datetime import timedelta
 from pathlib import Path
 from typing import TYPE_CHECKING
@@ -60,6 +61,7 @@ from documents.tests.utils import DirectoriesMixin
 from documents.tests.utils import DummyProgressManager
 from documents.tests.utils import FileSystemAssertsMixin
 from documents.tests.utils import SampleDirMixin
+from documents.workflows.actions import execute_password_removal_action
 from paperless_mail.models import MailAccount
 from paperless_mail.models import MailRule
 
@@ -1276,76 +1278,6 @@ class TestWorkflows(
             )
             self.assertIn(expected_str, cm.output[1])
 
-    def test_document_added_any_filters(self):
-        trigger = WorkflowTrigger.objects.create(
-            type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
-        )
-        trigger.filter_has_any_correspondents.set([self.c])
-        trigger.filter_has_any_document_types.set([self.dt])
-        trigger.filter_has_any_storage_paths.set([self.sp])
-
-        matching_doc = Document.objects.create(
-            title="sample test",
-            correspondent=self.c,
-            document_type=self.dt,
-            storage_path=self.sp,
-            original_filename="sample.pdf",
-            checksum="checksum-any-match",
-        )
-
-        matched, reason = existing_document_matches_workflow(matching_doc, trigger)
-        self.assertTrue(matched)
-        self.assertIsNone(reason)
-
-        wrong_correspondent = Document.objects.create(
-            title="wrong correspondent",
-            correspondent=self.c2,
-            document_type=self.dt,
-            storage_path=self.sp,
-            original_filename="sample2.pdf",
-        )
-        matched, reason = existing_document_matches_workflow(
-            wrong_correspondent,
-            trigger,
-        )
-        self.assertFalse(matched)
-        self.assertIn("correspondent", reason)
-
-        other_document_type = DocumentType.objects.create(name="Other")
-        wrong_document_type = Document.objects.create(
-            title="wrong doc type",
-            correspondent=self.c,
-            document_type=other_document_type,
-            storage_path=self.sp,
-            original_filename="sample3.pdf",
-            checksum="checksum-wrong-doc-type",
-        )
-        matched, reason = existing_document_matches_workflow(
-            wrong_document_type,
-            trigger,
-        )
-        self.assertFalse(matched)
-        self.assertIn("doc type", reason)
-
-        other_storage_path = StoragePath.objects.create(
-            name="Other path",
-            path="/other/",
-        )
-        wrong_storage_path = Document.objects.create(
-            title="wrong storage",
-            correspondent=self.c,
-            document_type=self.dt,
-            storage_path=other_storage_path,
-            original_filename="sample4.pdf",
-            checksum="checksum-wrong-storage-path",
-        )
-        matched, reason = existing_document_matches_workflow(
-            wrong_storage_path,
-            trigger,
-        )
-        self.assertFalse(matched)
-        self.assertIn("storage path", reason)
-
     def test_document_added_custom_field_query_no_match(self):
         trigger = WorkflowTrigger.objects.create(
             type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
@@ -1454,39 +1386,6 @@ class TestWorkflows(
         self.assertIn(doc1, filtered)
         self.assertNotIn(doc2, filtered)
 
-    def test_prefilter_documents_any_filters(self):
-        trigger = WorkflowTrigger.objects.create(
-            type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_ADDED,
-        )
-        trigger.filter_has_any_correspondents.set([self.c])
-        trigger.filter_has_any_document_types.set([self.dt])
-        trigger.filter_has_any_storage_paths.set([self.sp])
-
-        allowed_document = Document.objects.create(
-            title="allowed",
-            correspondent=self.c,
-            document_type=self.dt,
-            storage_path=self.sp,
-            original_filename="doc-allowed.pdf",
-            checksum="checksum-any-allowed",
-        )
-        blocked_document = Document.objects.create(
-            title="blocked",
-            correspondent=self.c2,
-            document_type=self.dt,
-            storage_path=self.sp,
-            original_filename="doc-blocked.pdf",
-            checksum="checksum-any-blocked",
-        )
-
-        filtered = prefilter_documents_by_workflowtrigger(
-            Document.objects.all(),
-            trigger,
-        )
-
-        self.assertIn(allowed_document, filtered)
-        self.assertNotIn(blocked_document, filtered)
-
     def test_consumption_trigger_requires_filter_configuration(self):
         serializer = WorkflowTriggerSerializer(
             data={
@@ -3713,6 +3612,196 @@ class TestWorkflows(
 
         mock_post.assert_called_once()
 
+    @mock.patch("documents.bulk_edit.remove_password")
+    def test_password_removal_action_attempts_multiple_passwords(
+        self,
+        mock_remove_password,
+    ):
+        """
+        GIVEN:
+            - Workflow password removal action
+            - Multiple passwords provided
+        WHEN:
+            - Document updated triggering the workflow
+        THEN:
+            - Password removal is attempted until one succeeds
+        """
+        doc = Document.objects.create(
+            title="Protected",
+            checksum="pw-checksum",
+        )
+        trigger = WorkflowTrigger.objects.create(
+            type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_UPDATED,
+        )
+        action = WorkflowAction.objects.create(
+            type=WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL,
+            passwords="wrong, right\n extra ",
+        )
+        workflow = Workflow.objects.create(name="Password workflow")
+        workflow.triggers.add(trigger)
+        workflow.actions.add(action)
+
+        mock_remove_password.side_effect = [
+            ValueError("wrong password"),
+            "OK",
+        ]
+
+        run_workflows(trigger.type, doc)
+
+        assert mock_remove_password.call_count == 2
+        mock_remove_password.assert_has_calls(
+            [
+                mock.call(
+                    [doc.id],
+                    password="wrong",
+                    update_document=True,
+                    user=doc.owner,
+                ),
+                mock.call(
+                    [doc.id],
+                    password="right",
+                    update_document=True,
+                    user=doc.owner,
+                ),
+            ],
+        )
+
+    @mock.patch("documents.bulk_edit.remove_password")
+    def test_password_removal_action_fails_without_correct_password(
+        self,
+        mock_remove_password,
+    ):
+        """
+        GIVEN:
+            - Workflow password removal action
+            - No correct password provided
+        WHEN:
+            - Document updated triggering the workflow
+        THEN:
+            - Password removal is attempted for all passwords and fails
+        """
+        doc = Document.objects.create(
+            title="Protected",
+            checksum="pw-checksum-2",
+        )
+        trigger = WorkflowTrigger.objects.create(
+            type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_UPDATED,
+        )
+        action = WorkflowAction.objects.create(
+            type=WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL,
+            passwords=" \n , ",
+        )
+        workflow = Workflow.objects.create(name="Password workflow missing passwords")
+        workflow.triggers.add(trigger)
+        workflow.actions.add(action)
+
+        run_workflows(trigger.type, doc)
+
+        mock_remove_password.assert_not_called()
+
+    @mock.patch("documents.bulk_edit.remove_password")
+    def test_password_removal_action_skips_without_passwords(
+        self,
+        mock_remove_password,
+    ):
+        """
+        GIVEN:
+            - Workflow password removal action with no passwords
+        WHEN:
+            - Workflow is run
+        THEN:
+            - Password removal is not attempted
+        """
+        doc = Document.objects.create(
+            title="Protected",
+            checksum="pw-checksum-2",
+        )
+        trigger = WorkflowTrigger.objects.create(
+            type=WorkflowTrigger.WorkflowTriggerType.DOCUMENT_UPDATED,
+        )
+        action = WorkflowAction.objects.create(
+            type=WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL,
+            passwords="",
+        )
+        workflow = Workflow.objects.create(name="Password workflow missing passwords")
+        workflow.triggers.add(trigger)
+        workflow.actions.add(action)
+
+        run_workflows(trigger.type, doc)
+
+        mock_remove_password.assert_not_called()
+
+    @mock.patch("documents.bulk_edit.remove_password")
+    def test_password_removal_consumable_document_deferred(
+        self,
+        mock_remove_password,
+    ):
+        """
+        GIVEN:
+            - Workflow password removal action
+            - Simulated consumption trigger (a ConsumableDocument is used)
+        WHEN:
+            - Document consumption is finished
+        THEN:
+            - Password removal is attempted
+        """
+        action = WorkflowAction.objects.create(
+            type=WorkflowAction.WorkflowActionType.PASSWORD_REMOVAL,
+            passwords="first, second",
+        )
+
+        temp_dir = Path(tempfile.mkdtemp())
+        original_file = temp_dir / "file.pdf"
+        original_file.write_bytes(b"pdf content")
+        consumable = ConsumableDocument(
+            source=DocumentSource.ApiUpload,
+            original_file=original_file,
+        )
+
+        execute_password_removal_action(action, consumable, logging_group=None)
+
+        mock_remove_password.assert_not_called()
+
+        mock_remove_password.side_effect = [
+            ValueError("bad password"),
+            "OK",
+        ]
+
+        doc = Document.objects.create(
+            checksum="pw-checksum-consumed",
+            title="Protected",
+        )
+
+        document_consumption_finished.send(
+            sender=self.__class__,
+            document=doc,
+        )
+
+        assert mock_remove_password.call_count == 2
+        mock_remove_password.assert_has_calls(
+            [
+                mock.call(
+                    [doc.id],
+                    password="first",
+                    update_document=True,
+                    user=doc.owner,
+                ),
+                mock.call(
+                    [doc.id],
+                    password="second",
+                    update_document=True,
+                    user=doc.owner,
+                ),
+            ],
+        )
+
+        # ensure handler disconnected after first run
+        document_consumption_finished.send(
+            sender=self.__class__,
+            document=doc,
+        )
+        assert mock_remove_password.call_count == 2
+
 
 class TestWebhookSend:
     def test_send_webhook_data_or_json(

src/documents/workflows/actions.py

@@ -1,4 +1,5 @@
 import logging
+import re
 from pathlib import Path
 
 from django.conf import settings
@@ -14,6 +15,7 @@ from documents.models import Document
 from documents.models import DocumentType
 from documents.models import WorkflowAction
 from documents.models import WorkflowTrigger
+from documents.signals import document_consumption_finished
 from documents.templating.workflows import parse_w_workflow_placeholders
 from documents.workflows.webhooks import send_webhook
 
@@ -259,3 +261,74 @@ def execute_webhook_action(
             f"Error occurred sending webhook: {e}",
             extra={"group": logging_group},
         )
+
+
+def execute_password_removal_action(
+    action: WorkflowAction,
+    document: Document | ConsumableDocument,
+    logging_group,
+) -> None:
+    """
+    Try to remove a password from a document using the configured list.
+    """
+    passwords = action.passwords
+    if not passwords:
+        logger.warning(
+            "Password removal action %s has no passwords configured",
+            action.pk,
+            extra={"group": logging_group},
+        )
+        return
+
+    passwords = [
+        password.strip()
+        for password in re.split(r"[,\n]", passwords)
+        if password.strip()
+    ]
+
+    if isinstance(document, ConsumableDocument):
+        # hook the consumption-finished signal to attempt password removal later
+        def handler(sender, **kwargs):
+            consumed_document: Document = kwargs.get("document")
+            if consumed_document is not None:
+                execute_password_removal_action(
+                    action,
+                    consumed_document,
+                    logging_group,
+                )
+            document_consumption_finished.disconnect(handler)
+
+        document_consumption_finished.connect(handler, weak=False)
+        return
+
+    # import here to avoid circular dependency
+    from documents.bulk_edit import remove_password
+
+    for password in passwords:
+        try:
+            remove_password(
+                [document.id],
+                password=password,
+                update_document=True,
+                user=document.owner,
+            )
+            logger.info(
+                "Removed password from document %s using workflow action %s",
+                document.pk,
+                action.pk,
+                extra={"group": logging_group},
+            )
+            return
+        except ValueError as e:
+            logger.warning(
+                "Password removal failed for document %s with supplied password: %s",
+                document.pk,
+                e,
+                extra={"group": logging_group},
+            )
+
+    logger.error(
+        "Password removal failed for document %s after trying all provided passwords",
+        document.pk,
+        extra={"group": logging_group},
+    )