Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] Tags user has no permissions for show as "Private" after file upload
### Description

When a user uploads a file that triggers Tag-Rules of other users the "detected" Tags show up as Private as the uploading user does not have the permissions to view these Tags.

(The image is german so Privat = Private)
![s8u2Hd0b07ZqJ5n5](https://user-images.githubusercontent.com/46486021/234629541-7e37e389-c3b6-4ac6-bb4a-f201ecd6f2af.png)

I don't know if that is a feature or not ... for me its confusing.

("Neu" is the Inbox-Tag ... the only one that should show here)

### Steps to reproduce

1. Login as User A
2. Create Tag "Test" with rule to add when "Test" is detected as a Word in the Document
3. Set Permission of this Tag to User A only
4. Login as User B
5. Upload a file with the word "Test" in it
6. See a Private-Tag added by paperless

### Webserver logs

```bash
-
```


### Browser logs

```bash
-
```


### Paperless-ngx version

1.14.0

### Host OS

Synology DSM 7.1.1-42962 Update 5

### Installation method

Docker - official image

### Browser

Chrome

### Configuration changes

-

### Other

-


Discussion:
Hmm, this should actually be handled, what permissions does user B have for the Tag?

https://github.com/paperless-ngx/paperless-ngx/blob/c385355c2b76c83e7b5d85936d2e2db007f91011/src/documents/matching.py#L60-L67
The following is configured:

User A (Test1):
![image](https://user-images.githubusercontent.com/46486021/234633976-dc148b3b-607f-47e4-8a0e-9c88fa2347bf.png)

User B (Test2)
![image](https://user-images.githubusercontent.com/46486021/234633976-dc148b3b-607f-47e4-8a0e-9c88fa2347bf.png)

Tag "Test":
![image](https://user-images.githubusercontent.com/46486021/234634352-5e3c3b97-bbc8-4871-8849-5942012adb91.png)

So User B should not be able to see Tag "Test" as the owner is User A correct?
More precisely he should not even be are of any Tags present other than his own or Tags he has permissions for.

Yes, and assuming you uploaded the doc via the UI i.e. the doc was uploaded with an owner?
Correct I uploaded via User B (Test 2) ... so the owner with no permissions over Tag "Test" that's why the Tag is displayed as "Private" instead of "Test" I suppose.

It feels like the OCR is running and finding Tags adding them to the document and just after that the permission system kicks in and displays them as Private instead of removing them. It would be even better if the OCR would not try to match Tags the user has no permission for in the first place tho.
I see the issue, will get it sorted thanks

Resolving patch:
diff --git a/src/documents/matching.py b/src/documents/matching.py
--- a/src/documents/matching.py
+++ b/src/documents/matching.py
@@ -22,6 +22,9 @@ def log_reason(matching_model, document, reason):
 def match_correspondents(document, classifier, user=None):
     pred_id = classifier.predict_correspondent(document.content) if classifier else None
 
+    if user is None and document.owner is not None:
+        user = document.owner
+
     if user is not None:
         correspondents = get_objects_for_user_owner_aware(
             user,
@@ -39,6 +42,9 @@ def match_correspondents(document, classifier, user=None):
 def match_document_types(document, classifier, user=None):
     pred_id = classifier.predict_document_type(document.content) if classifier else None
 
+    if user is None and document.owner is not None:
+        user = document.owner
+
     if user is not None:
         document_types = get_objects_for_user_owner_aware(
             user,
@@ -56,6 +62,9 @@ def match_document_types(document, classifier, user=None):
 def match_tags(document, classifier, user=None):
     predicted_tag_ids = classifier.predict_tags(document.content) if classifier else []
 
+    if user is None and document.owner is not None:
+        user = document.owner
+
     if user is not None:
         tags = get_objects_for_user_owner_aware(user, "documents.view_tag", Tag)
     else:
@@ -69,6 +78,9 @@ def match_tags(document, classifier, user=None):
 def match_storage_paths(document, classifier, user=None):
     pred_id = classifier.predict_storage_path(document.content) if classifier else None
 
+    if user is None and document.owner is not None:
+        user = document.owner
+
     if user is not None:
         storage_paths = get_objects_for_user_owner_aware(
             user,


Test patch: