Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] Owner of new correspondent is automatically set by backend, creates visibility issue
### Description

Currently when creating a new correspondent and purposefully leaving the owner empty, it gets set to the current user anyway when saving. In a multi-user environment this means the new correspondent won't be visible to anyone else by default.

To correct this, one has to edit every new correspondent again after creating it and delete the owner.

For me it feels inconsistent if I do not see an owner in the "Create new correspondent"-dialog, but the item gets saved with an assigned owner anyway. Needing to open the same dialog twice to achieve the desired settings is inconvenient.

### Steps to reproduce

1. Go to the "Correspondents"-list.
2. Click "Create"
3. Give it a name and purposefully leave the owner empty to achive the described result:
"Objects without an owner can be viewed and edited by all users"

![Screenshot 2023-05-08 094113](https://user-images.githubusercontent.com/39916925/236767494-7565233b-e16b-48eb-8d92-590bf0b641d6.png)

4. Click "Save"
5. "Edit" this correspondent
6.  See that an owner was assigned anyway

![Screenshot 2023-05-08 094152](https://user-images.githubusercontent.com/39916925/236767924-54ee9a22-9464-42a5-8834-321f49b2ecff.png)

7. (Now I need to delete the owner again to make the correspondent visible to anyone as desired)

### Webserver logs

```bash
There are no logs regarding this event.
```


### Browser logs

_No response_

### Paperless-ngx version

Paperless-ngx 1.14.4

### Host OS

Ubuntu 22.04

### Installation method

Docker - official image

### Browser

Chrome

### Configuration changes

_No response_

### Other

_No response_


Discussion:

Resolving patch:
diff --git a/src/documents/serialisers.py b/src/documents/serialisers.py
--- a/src/documents/serialisers.py
+++ b/src/documents/serialisers.py
@@ -220,6 +220,8 @@ def create(self, validated_data):
         permissions = None
         if "set_permissions" in validated_data:
             permissions = validated_data.pop("set_permissions")
+            if "user" not in permissions or permissions["user"] is None:
+                validated_data["owner"] = None
         instance = super().create(validated_data)
         if permissions is not None:
             self._set_permissions(permissions, instance)


Test patch:
diff --git a/src/documents/tests/test_api.py b/src/documents/tests/test_api.py
--- a/src/documents/tests/test_api.py
+++ b/src/documents/tests/test_api.py
@@ -3532,6 +3532,77 @@ def test_object_permissions(self):
             status.HTTP_404_NOT_FOUND,
         )
 
+    def test_api_set_permissions(self):
+        """
+        GIVEN:
+            - API request to create an object (Tag) that supplies set_permissions object
+        WHEN:
+            - owner is passed as null or as a user id
+            - view > users is set
+        THEN:
+            - Object permissions are set appropriately
+        """
+        user1 = User.objects.create_superuser(username="user1")
+        user2 = User.objects.create(username="user2")
+
+        self.client.force_authenticate(user1)
+
+        response = self.client.post(
+            "/api/tags/",
+            json.dumps(
+                {
+                    "name": "test1",
+                    "matching_algorithm": MatchingModel.MATCH_AUTO,
+                    "set_permissions": {
+                        "owner": None,
+                        "view": {
+                            "users": None,
+                            "groups": None,
+                        },
+                        "change": {
+                            "users": None,
+                            "groups": None,
+                        },
+                    },
+                },
+            ),
+            content_type="application/json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
+
+        tag1 = Tag.objects.filter(name="test1").first()
+        self.assertEqual(tag1.owner, None)
+
+        response = self.client.post(
+            "/api/tags/",
+            json.dumps(
+                {
+                    "name": "test2",
+                    "matching_algorithm": MatchingModel.MATCH_AUTO,
+                    "set_permissions": {
+                        "owner": user1.id,
+                        "view": {
+                            "users": [user2.id],
+                            "groups": None,
+                        },
+                        "change": {
+                            "users": None,
+                            "groups": None,
+                        },
+                    },
+                },
+            ),
+            content_type="application/json",
+        )
+
+        tag2 = Tag.objects.filter(name="test2").first()
+
+        from guardian.core import ObjectPermissionChecker
+
+        checker = ObjectPermissionChecker(user2)
+        self.assertEqual(checker.has_perm("view_tag", tag2), True)
+
     def test_dynamic_permissions_fields(self):
         Document.objects.create(title="Test", content="content 1", checksum="1")