Repository: paperless-ngx/paperless-ngx

Issue:
[BUG] Bulk editing not working in 1.14.1-1.14.4
### Description

I have a paperless-ngx instance (1.14.4) with one super user which is only user for administrative tasks and two normal users with a wide range of permissions (every permission expect admin row and expect adding, updating and deleting groups/users) which are used by myself and my partner for adding and managing documents.

Here the permission matrix of the both users:
![image](https://user-images.githubusercontent.com/15156011/236683771-86545db5-2478-4671-841b-29df98ef0815.png)

I now have observed the following behaviour: When adding a new document to paperless I set the owner respectively to the user this documents belongs using my normal user account. When adding documents of my partner and changing the owner to her user and setting the permissions so my partner and I have viewing and editing rights this seems to work: I am still able to view, edit tags, correspondent, etc. of the document in the document detail view. However this is not true, when trying to edit the same document in the overview using the bulk editing feature.



### Steps to reproduce

1. Create two non-super users _foo_ and _bar_ with wide editing permissions.
2. Add or edit a document with the following permission settings:
 - Owner: bar
 - View: Users: foo, bar
 - Edit: Users: foo, bar
3. Result: The document is editable by _foo_ when opened in the detail view. The document cannot be edited by _foo_ using bulk editing in the document overview.

Expectation: The document can be edited by _foo_ using bulk editing as well, since the user has the permission to edit the document.

### Webserver logs

```bash
none
```


### Browser logs

```bash
none
```


### Paperless-ngx version

1.14.4

### Host OS

Synology DSM 7.1.1

### Installation method

Docker - official image

### Browser

Reproduced in_Firefox_, _Edge_

### Configuration changes

_No response_

### Other

_No response_


Discussion:

Resolving patch:
diff --git a/src/documents/views.py b/src/documents/views.py
--- a/src/documents/views.py
+++ b/src/documents/views.py
@@ -270,11 +270,9 @@ def get_queryset(self):
         return Document.objects.distinct().annotate(num_notes=Count("notes"))
 
     def get_serializer(self, *args, **kwargs):
-        super().get_serializer(*args, **kwargs)
         fields_param = self.request.query_params.get("fields", None)
         fields = fields_param.split(",") if fields_param else None
         truncate_content = self.request.query_params.get("truncate_content", "False")
-        serializer_class = self.get_serializer_class()
         kwargs.setdefault("context", self.get_serializer_context())
         kwargs.setdefault("fields", fields)
         kwargs.setdefault("truncate_content", truncate_content.lower() in ["true", "1"])
@@ -282,7 +280,7 @@ def get_serializer(self, *args, **kwargs):
             "full_perms",
             self.request.query_params.get("full_perms", False),
         )
-        return serializer_class(*args, **kwargs)
+        return super().get_serializer(*args, **kwargs)
 
     def update(self, request, *args, **kwargs):
         response = super().update(request, *args, **kwargs)


Test patch:
diff --git a/src/documents/tests/test_api.py b/src/documents/tests/test_api.py
--- a/src/documents/tests/test_api.py
+++ b/src/documents/tests/test_api.py
@@ -3533,9 +3533,28 @@ def test_object_permissions(self):
         )
 
     def test_dynamic_permissions_fields(self):
+        user1 = User.objects.create_user(username="user1")
+        user1.user_permissions.add(*Permission.objects.filter(codename="view_document"))
+        user2 = User.objects.create_user(username="user2")
+
         Document.objects.create(title="Test", content="content 1", checksum="1")
+        doc2 = Document.objects.create(
+            title="Test2",
+            content="content 2",
+            checksum="2",
+            owner=user2,
+        )
+        doc3 = Document.objects.create(
+            title="Test3",
+            content="content 3",
+            checksum="3",
+            owner=user2,
+        )
+
+        assign_perm("view_document", user1, doc2)
+        assign_perm("view_document", user1, doc3)
+        assign_perm("change_document", user1, doc3)
 
-        user1 = User.objects.create_superuser(username="test1")
         self.client.force_authenticate(user1)
 
         response = self.client.get(
@@ -3549,6 +3568,9 @@ def test_dynamic_permissions_fields(self):
 
         self.assertNotIn("permissions", resp_data["results"][0])
         self.assertIn("user_can_change", resp_data["results"][0])
+        self.assertEqual(resp_data["results"][0]["user_can_change"], True)  # doc1
+        self.assertEqual(resp_data["results"][1]["user_can_change"], False)  # doc2
+        self.assertEqual(resp_data["results"][2]["user_can_change"], True)  # doc3
 
         response = self.client.get(
             "/api/documents/?full_perms=true",