Merge branch 'main' into refactor-filename-regex-constant-13933144971632372772

.dockerignore

@@ -0,0 +1,91 @@
+# =============================================================================
+# Docker build context exclusions
+# Reducing the build context speeds up builds and prevents unnecessary cache
+# invalidation when unrelated files change.
+# =============================================================================
+
+# ── Version control ──────────────────────────────────────────────────────────
+.git
+
+# ── GitHub / CI tooling ──────────────────────────────────────────────────────
+.github
+
+# ── IDE / local dev ──────────────────────────────────────────────────────────
+.vscode
+.jules
+
+# ── Pre-commit / linting config (not needed at runtime) ──────────────────────
+.pre-commit-config.yaml
+pyproject.toml
+codecov.yml
+crowdin.yml
+
+# ── Test suite ───────────────────────────────────────────────────────────────
+tests/
+requirements-dev.txt
+coverage.json
+COVERAGE_REPORT.md
+.coverage
+htmlcov/
+.pytest_cache/
+junit.xml
+coverage.xml
+
+# ── Mobile app / browser extension / legacy placeholder ─────────────────────
+# backend/ is an empty placeholder directory not part of the Python application
+mobile/
+browser-extension/
+backend/
+
+# ── Helm charts ──────────────────────────────────────────────────────────────
+helm/
+
+# ── Scripts (run before Docker build, output files are COPYd separately) ─────
+scripts/
+
+# ── Benchmark and one-off utility scripts ────────────────────────────────────
+benchmark_*.py
+fix_test*.py
+run_fast_tests.sh
+
+# ── Root-level Markdown files (docs/ is kept for docs-builder stage) ─────────
+# Note: *.md only matches files at the root level, not inside subdirectories
+*.md
+
+# ── Python bytecode / compiled artifacts ─────────────────────────────────────
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+*.so
+*.egg
+*.egg-info/
+
+# ── Virtual environments ──────────────────────────────────────────────────────
+.venv/
+venv/
+env/
+
+# ── Environment / secret files ───────────────────────────────────────────────
+.env
+.env.local
+.env.*.local
+
+# ── Runtime state files ───────────────────────────────────────────────────────
+*.log
+celerybeat-schedule
+celerybeat.pid
+
+# ── Build artifacts ───────────────────────────────────────────────────────────
+build/
+dist/
+.cache/
+.mypy_cache/
+.ruff_cache/
+site/
+docs_build/
+
+# ── Editor temp files ─────────────────────────────────────────────────────────
+*.swp
+*.swo
+*~

.env.demo

@@ -7,6 +7,28 @@ GOTENBERG_URL=http://gotenberg:3000
 ALLOW_FILE_DELETE=true  # Allow deletion of file records
 COMPLIANCE_ENABLED=true  # Enable compliance templates dashboard (GDPR, HIPAA, SOC 2)
 
+# **System Reset / Factory Reset**
+# FACTORY_RESET_ON_STARTUP=false  # Wipe all user data on every startup (demo/testing only)
+# ENABLE_FACTORY_RESET=false      # Show the System Reset page in admin UI
+
+# **Logging**
+# LOG_LEVEL controls the Python root-logger level.
+# Accepted values: DEBUG, INFO, WARNING, ERROR, CRITICAL (default: INFO).
+# When DEBUG=true and LOG_LEVEL is not set, the level is automatically lowered to DEBUG.
+# LOG_LEVEL=INFO
+# DEBUG=false
+
+# Log output format: "text" (human-readable, default) or "json" (structured JSON lines).
+# Use "json" when shipping logs to Grafana Loki, Splunk, ELK, Datadog, or any SIEM.
+# LOG_FORMAT=text
+
+# Forward application logs to a syslog receiver (in addition to stdout).
+# Useful for traditional (non-container) deployments and centralised SIEM ingestion.
+# LOG_SYSLOG_ENABLED=false
+# LOG_SYSLOG_HOST=localhost
+# LOG_SYSLOG_PORT=514
+# LOG_SYSLOG_PROTOCOL=udp          # udp | tcp
+
 # **UI / Appearance**
 # Default colour scheme: system (follow OS), light, or dark
 # Individual users can always override with the navbar dark-mode toggle.
@@ -142,6 +164,16 @@ AUTH_ENABLED=true
 # Generate a secure random string, for example:
 # python -c "import secrets; print(secrets.token_hex(32))"
 SESSION_SECRET=b39fd43f68d0491ca942f28a16e484b1e763fe9accf4445ca2669a5f3b179eb4
+
+# Session lifetime in days (default: 30). Common values: 30, 60, 90.
+# Determines how long a user stays logged in before needing to re-authenticate.
+# SESSION_LIFETIME_DAYS=30
+# Override with a custom value (takes precedence over SESSION_LIFETIME_DAYS):
+# SESSION_LIFETIME_CUSTOM_DAYS=
+
+# Time-to-live in seconds for QR code login challenges (default: 120 = 2 minutes).
+# QR_LOGIN_CHALLENGE_TTL_SECONDS=120
+
 ADMIN_USERNAME=admin
 ADMIN_PASSWORD=your_secure_password
 ADMIN_GROUP_NAME=admin
@@ -240,6 +272,13 @@ OPENAI_MODEL=gpt-4o-mini
 # AZURE_OPENAI_API_VERSION=2024-02-01
 # AI_MODEL=gpt-4o   # deployment name in Azure
 
+# **Document Translation**
+# After processing, documents whose detected language differs from the default
+# target language are automatically translated.  Only the original and this
+# default-language version are persisted; other translations are on-the-fly.
+# Users can override this in their profile settings.
+# DEFAULT_DOCUMENT_LANGUAGE=en
+
 # Azure Document Intelligence (OCR – separate from AI provider above)
 # **Email Settings (shared SMTP – password reset, verification, and system notifications)**
 EMAIL_HOST=smtp.example.com
@@ -408,6 +447,15 @@ ONEDRIVE_TENANT_ID=common
 ONEDRIVE_REFRESH_TOKEN=your-refresh-token
 ONEDRIVE_FOLDER_PATH=Documents/Uploads
 
+# SharePoint
+SHAREPOINT_CLIENT_ID=your-client-id
+SHAREPOINT_CLIENT_SECRET=your-client-secret
+SHAREPOINT_TENANT_ID=common
+SHAREPOINT_REFRESH_TOKEN=your-refresh-token
+SHAREPOINT_SITE_URL=https://tenant.sharepoint.com/sites/sitename
+SHAREPOINT_DOCUMENT_LIBRARY=Documents
+SHAREPOINT_FOLDER_PATH=Uploads
+
 # WebDAV
 # WEBDAV_ENABLED=true  # Set to false to disable WebDAV uploads without removing credentials
 WEBDAV_URL=https://webdav.example.com/path

.github/copilot-instructions.md

@@ -163,6 +163,13 @@ pytest --tb=short -q
 - Keep JavaScript minimal - prefer server-side rendering
 - Follow existing template structure and patterns
 
+### Internationalization (i18n) & Localization (l10n)
+- **Always** use the `_("key")` helper in Jinja2 templates and `translate("key", locale)` in Python for every user-visible string — never hardcode UI text.
+- **Only add new keys to `frontend/translations/en.json`** — that is the one and only file you must touch when introducing new UI strings.
+- Do **not** manually edit any non-English translation file (`de.json`, `fr.json`, etc.). An external automation script syncs all other language files from `en.json` automatically.
+- Key naming convention: `<section>.<descriptor>` in snake_case, e.g. `language.search_placeholder`, `nav.help`, `common.cancel`.
+- The `test_all_languages_have_same_keys` check has been intentionally removed — key completeness across locales is enforced by the external sync script, not by the test suite.
+
 ### Testing
 - Write tests in `tests/` directory, mirroring `app/` structure
 - Use pytest markers: `@pytest.mark.unit`, `@pytest.mark.integration`, etc.

.github/workflows/ci.yml

@@ -44,6 +44,18 @@ jobs:
       - run: ruff check app/ tests/
       - run: ruff format --check app/ tests/
 
+  migration-chain:
+    name: Alembic Migration Chain Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Validate migration chain
+        run: python scripts/check_alembic_migrations.py
+
   html-lint:
     name: HTML Accessibility Lint
     runs-on: ubuntu-latest
@@ -138,7 +150,7 @@ jobs:
   build:
     name: Build & Push Docker Image
     runs-on: ubuntu-latest
-    needs: [run-tests, mypy, dependency-scan, html-lint]
+    needs: [run-tests, mypy, dependency-scan, html-lint, migration-chain]
     if: github.event_name == 'push'
     steps:
       - name: Checkout Code

.jules/sentinel.md

@@ -0,0 +1,17 @@
+## 2024-05-24 - SSRF in WebDAV connection test
+**Vulnerability:** The `_test_webdav_connection` function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., `127.0.0.1`).
+**Learning:** DNS resolution is required for robust SSRF protection when validating URLs provided by users.
+**Prevention:** Use a centralized `is_private_ip` function (now in `app/utils/network.py`) that resolves the hostname to its IPs and checks if any are private.
+## 2026-03-22 - B310: urllib.request.urlopen replaced with httpx
+**Vulnerability:** The `_test_webdav_connection` function used `urllib.request.urlopen`, which natively supports dangerous schemes like `file://` or `ftp://` and follows redirects by default, potentially allowing SSRF bypasses or Local File Inclusion.
+**Learning:** `urllib.request` should be avoided for user-supplied URLs. Even when URL schemes are manually validated, `urllib`'s default redirect following behavior can bypass SSRF protections (e.g. redirecting to `127.0.0.1`).
+**Prevention:** Use a modern, safer HTTP client like `httpx` with `follow_redirects=False` when testing user-provided URLs.
+
+## 2026-03-20 - Safe Path Traversal Prevention in Low-Level Utilities
+**Vulnerability:** The generic file utility `hash_file` in `app/utils/file_operations.py` accepted any file path and was vulnerable to reading arbitrary files via path traversal (e.g., `../../../etc/passwd`) or absolute paths if an attacker could control the `filepath` argument.
+**Learning:** Naively checking for `".." in path` breaks legitimate relative paths used internally by the application. Blocking absolute paths entirely also breaks functionality. Input validation should occur at the API boundary, but for defense-in-depth, low-level utilities must enforce expected boundaries (e.g., the application's `workdir`).
+**Prevention:** Use `pathlib.Path.resolve()` on both the target path and the allowed base directory (`settings.workdir`). Ensure the resolved target path is strictly within the allowed boundary using `filepath_obj.relative_to(workdir_obj)`, catching the `ValueError` that is raised when the path is out of bounds. This safely blocks both relative traversal attacks and arbitrary absolute paths.
+## 2025-05-18 - [SSRF Bypass via DNS Resolution Failure]
+**Vulnerability:** The `is_private_ip` function in `app/utils/network.py` failed open (returned `False`) when a hostname could not be resolved (`socket.gaierror`).
+**Learning:** This fail-open pattern was originally added to allow external domains in tests, but in production, it created a severe SSRF risk. An attacker could bypass SSRF protections by providing a URL that fails to resolve during the security check but resolves later (DNS rebinding), or by exploiting internal routing behaviors via unresolvable addresses.
+**Prevention:** Always fail securely in network authorization functions. If a domain cannot be resolved to verify its safety, the request must be blocked (`return True` / default-deny). Tests should mock DNS resolution correctly instead of compromising production security logic.

.pre-commit-config.yaml

@@ -48,6 +48,16 @@ repos:
             .env.demo
           )$
 
+  # Alembic migration chain validation
+  - repo: local
+    hooks:
+      - id: check-alembic-migrations
+        name: Check Alembic migration chain
+        entry: python scripts/check_alembic_migrations.py
+        language: python
+        pass_filenames: false
+        files: ^migrations/versions/.*\.py$
+
   # Conventional commits validation
   - repo: https://github.com/compilerla/conventional-pre-commit
     rev: v3.0.0

BUILD_DATE

@@ -1 +1 @@
-2026-03-13T14:54:25Z
+2026-03-23T16:27:32Z

Dockerfile

@@ -1,14 +1,34 @@
-# Use multi-stage build for a smaller final image
-FROM python:3.14.1 AS builder
+# syntax=docker/dockerfile:1
 
-WORKDIR /app
+# ── Stage 1: Python dependency builder ──────────────────────────────────────
+# Use the same slim variant as the runtime to keep Python versions in sync.
+# build-essential + libffi-dev cover the few packages (e.g. cryptography) that
+# need a C compiler; they are discarded after this stage.
+FROM python:3.14.3-slim AS builder
 
-# Copy requirements first for better layer caching
-COPY requirements.txt /app/
-RUN pip install --no-cache-dir -r requirements.txt
+WORKDIR /build
 
-# ── Documentation build stage ───────────────────────────────────────────────
-FROM python:3.14.1-slim AS docs-builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential \
+        libffi-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create an isolated virtual environment so only installed packages are copied
+# to the runtime image (no pip, setuptools, or other builder artefacts).
+RUN python -m venv /opt/venv
+
+ENV PATH="/opt/venv/bin:$PATH" \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1
+
+COPY requirements.txt /build/
+RUN pip install --no-cache-dir -r requirements.txt \
+    # Remove bytecode and cache to keep the venv lean
+    && find /opt/venv -type f -name "*.pyc" -delete \
+    && find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true
+
+# ── Stage 2: Documentation builder ──────────────────────────────────────────
+FROM python:3.14.3-slim AS docs-builder
 
 WORKDIR /docs
 
@@ -23,14 +43,13 @@ COPY mkdocs.yml /docs/mkdocs.yml
 # Build the static documentation site
 RUN mkdocs build --config-file /docs/mkdocs.yml --site-dir /docs/docs_build
 
-# Second stage for the actual runtime
+# ── Stage 3: Runtime image ───────────────────────────────────────────────────
 FROM python:3.14.3-slim
 
 WORKDIR /app
 
-# Copy installed packages from builder stage
-COPY --from=builder /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
-COPY --from=builder /usr/local/bin /usr/local/bin
+# Copy only the pre-built virtual environment from the builder
+COPY --from=builder /opt/venv /opt/venv
 
 # Install system-level OCR tools required for local OCR workflows:
 #   tesseract-ocr   – OCR engine used by pytesseract and ocrmypdf
@@ -62,15 +81,14 @@ COPY ./RUNTIME_INFO /app/RUNTIME_INFO
 # Copy the pre-built MkDocs documentation site (served at /help)
 COPY --from=docs-builder /docs/docs_build /app/docs_build
 
-# Create runtime_info directory
-RUN mkdir -p /app/runtime_info
-
-# Create necessary directories
-RUN mkdir -p /workdir
+# Create necessary runtime directories in a single layer
+RUN mkdir -p /app/runtime_info /workdir
 
 # Set environment variables
-ENV PYTHONPATH=/app
-ENV PYTHONUNBUFFERED=1
+ENV PATH="/opt/venv/bin:$PATH" \
+    PYTHONPATH=/app \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
 
 # Expose the port the app runs on
 EXPOSE 8000

Dockerfile.local

@@ -1,13 +1,31 @@
+# syntax=docker/dockerfile:1
+
 # Local development Dockerfile (avoids CI-only build metadata files)
-FROM python:3.14.1 AS builder
 
-WORKDIR /app
+# ── Stage 1: Python dependency builder ──────────────────────────────────────
+FROM python:3.14.3-slim AS builder
 
-COPY requirements.txt /app/
-RUN pip install --no-cache-dir -r requirements.txt
+WORKDIR /build
 
-# ── Documentation build stage ───────────────────────────────────────────────
-FROM python:3.14.1-slim AS docs-builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        build-essential \
+        libffi-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create an isolated virtual environment
+RUN python -m venv /opt/venv
+
+ENV PATH="/opt/venv/bin:$PATH" \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_NO_CACHE_DIR=1
+
+COPY requirements.txt /build/
+RUN pip install --no-cache-dir -r requirements.txt \
+    && find /opt/venv -type f -name "*.pyc" -delete \
+    && find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true
+
+# ── Stage 2: Documentation builder ──────────────────────────────────────────
+FROM python:3.14.3-slim AS docs-builder
 
 WORKDIR /docs
 
@@ -19,23 +37,25 @@ COPY mkdocs.yml /docs/mkdocs.yml
 
 RUN mkdocs build --config-file /docs/mkdocs.yml --site-dir /docs/docs_build
 
-FROM python:3.14.1-slim
+# ── Stage 3: Runtime image ───────────────────────────────────────────────────
+FROM python:3.14.3-slim
 
 WORKDIR /app
 
-COPY --from=builder /usr/local/lib/python3.14/site-packages /usr/local/lib/python3.14/site-packages
-COPY --from=builder /usr/local/bin /usr/local/bin
+COPY --from=builder /opt/venv /opt/venv
 
 # Install system-level OCR tools required for local OCR workflows:
 #   tesseract-ocr   – OCR engine used by pytesseract and ocrmypdf
 #   ghostscript     – required by ocrmypdf for PDF/PS operations
 #   poppler-utils   – provides pdfinfo/pdftoppm used by pdf2image
 #   unpaper         – optional deskewing pre-processor used by ocrmypdf
+#   wget            – used by ocr_language_manager to download tessdata files
 RUN apt-get update && apt-get install -y --no-install-recommends \
         tesseract-ocr \
         ghostscript \
         poppler-utils \
         unpaper \
+        wget \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 COPY ./app /app/app
@@ -53,11 +73,13 @@ COPY --from=docs-builder /docs/docs_build /app/docs_build
 RUN echo "local" > /app/GIT_SHA \
     && echo "local" > /app/RUNTIME_INFO
 
-RUN mkdir -p /app/runtime_info
-RUN mkdir -p /workdir
+# Create necessary runtime directories in a single layer
+RUN mkdir -p /app/runtime_info /workdir
 
-ENV PYTHONPATH=/app
-ENV PYTHONUNBUFFERED=1
+ENV PATH="/opt/venv/bin:$PATH" \
+    PYTHONPATH=/app \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1
 
 EXPOSE 8000
 

GIT_SHA

@@ -1 +1 @@
-a47db95
+2a5296d

README.md

@@ -24,121 +24,154 @@
 </div>
 
 <div align="center">
-  <a href="https://www.docuelevate.org"><img src="frontend/static/hero.png" alt="DocuElevate Logo" width="80%" /></a>
+  <a href="https://www.docuelevate.org"><img src="frontend/static/hero.png" alt="DocuElevate Hero" width="80%" /></a>
 </div>
 
 ## Overview
 
-DocuElevate automates the handling, extraction, and processing of documents using a variety of services, including:
+DocuElevate is an intelligent document processing system that automates the ingestion, OCR, AI-powered metadata extraction, and distribution of documents. It supports a wide range of AI providers, OCR engines, and cloud storage destinations out of the box.
 
-- **AI Provider** (pluggable – OpenAI, Anthropic, Gemini, Ollama, OpenRouter, Portkey, and more) for metadata extraction and text refinement.
-- **Dropbox**, **Nextcloud**, and **Google Drive** for file storage and uploads.
-- **Paperless NGX** for document indexing and management.
-- **Azure Document Intelligence** for OCR on PDFs.
-- **Gotenberg** for file-to-PDF conversions.
-- **Authentik** for authentication and user management.
+**Key capabilities:**
 
-It is designed for flexibility and configurability through environment variables, making it easily customizable for different workflows. The system can fetch documents from multiple IMAP mailboxes, process them (OCR, metadata extraction, PDF conversion), and store them in the desired destinations.
+- **AI-Powered Metadata Extraction** — pluggable AI providers including OpenAI, Anthropic Claude, Google Gemini, Ollama (local), OpenRouter, Portkey, and Azure OpenAI via LiteLLM
+- **Multi-Engine OCR** — Azure Document Intelligence, Tesseract, EasyOCR, Mistral OCR, Google Cloud Document AI, and AWS Textract with configurable merge strategies
+- **12 Storage Destinations** — Dropbox, Google Drive, OneDrive, Amazon S3, Nextcloud, WebDAV, FTP, SFTP, iCloud Drive, Email (SMTP), Paperless-ngx, and Rclone
+- **Multi-Channel Ingestion** — web upload, browser extension, mobile app, CLI, REST API, IMAP email, and watched folders (local, cloud, FTP/SFTP)
+- **Processing Pipelines** — customizable multi-step workflows with conditional routing rules
+- **Full-Text Search** — powered by Meilisearch for instant document discovery
+- **Multi-User with SSO** — local accounts, OAuth2/OIDC (Authentik), and social login (Google, Microsoft, Apple, Dropbox)
 
-The project includes a **UI** for uploading and managing files, and an API documentation page is available at `/docs` (powered by **FastAPI**).
-
-## Documentation Index
-
-- [User Guide](docs/UserGuide.md) - How to use DocuElevate
-- [Browser Extension Guide](docs/BrowserExtension.md) - Install and use the browser extension
-- [API Documentation](docs/API.md) - API reference
-- [Deployment Guide](docs/DeploymentGuide.md) - How to deploy DocuElevate
-- [Configuration Guide](docs/ConfigurationGuide.md) - Available configuration options
-- [Build Metadata](docs/BuildMetadata.md) - Automated version and build information
-- [CI/CD Tools Guide](docs/CIToolsGuide.md) - CI/CD pipeline and tool documentation
-- [CI Workflow Guide](docs/CIWorkflow.md) - Detailed workflow documentation
-- [Development Guide](CONTRIBUTING.md) - How to contribute to DocuElevate
-- [Troubleshooting](docs/Troubleshooting.md) - Common issues and solutions
+The project ships with a web UI, a REST + GraphQL API, a CLI tool, a native mobile app (iOS & Android), a browser extension, and Helm charts for Kubernetes deployment.
 
 ## Screenshots
 
 <div align="center">
   <img src="docs/upload-view.png" alt="DocuElevate Upload Interface" width="80%" />
-  <p><em>Upload interface for adding new documents</em></p>
+  <p><em>Upload interface — drag-and-drop file upload with real-time progress</em></p>
 
   <img src="docs/files-view.png" alt="DocuElevate Files View" width="80%" />
-  <p><em>Files view with processed documents and metadata</em></p>
+  <p><em>Files view — processed documents with AI-extracted metadata</em></p>
+
+  <img src="docs/status-view.png" alt="DocuElevate Status View" width="80%" />
+  <p><em>Status view — system health and service monitoring</em></p>
 </div>
 
 > **Note:** Screenshots may not reflect the very latest UI. For the most current look, visit [docuelevate.org](https://www.docuelevate.org).
 
-## Workflow Process
-
-DocuElevate follows a streamlined document processing workflow:
+## Workflow
 
 <div align="center">
   <img src="docs/workflow-diagram.png" alt="DocuElevate Workflow" width="90%" />
 </div>
 
-### Document Ingestion
-Documents enter DocuElevate through four possible channels:
-1. **Web Upload**: Users manually upload files via the web interface
-2. **Browser Extension**: Send files directly from your browser with one click
-3. **Email Attachments**: Automatic polling of configured IMAP mailboxes (supports multiple accounts)
-4. **API**: Direct programmatic uploads via the REST API
+### Ingestion
+
+Documents enter DocuElevate through multiple channels:
+
+| Channel | Description |
+|---------|-------------|
+| **Web Upload** | Drag-and-drop interface with real-time progress (up to 1 GB per file) |
+| **Browser Extension** | Clip web pages or send files from Chrome, Firefox, or Edge |
+| **Mobile App** | Capture documents with the device camera or upload from the photo library |
+| **CLI** | Batch uploads and scripted workflows via the `docuelevate` command-line tool |
+| **REST API** | Programmatic uploads with full API-token authentication |
+| **Email (IMAP)** | Automatic polling of multiple mailboxes with attachment filtering |
+| **Watched Folders** | Monitor local paths, FTP, SFTP, S3, Dropbox, Google Drive, OneDrive, Nextcloud, or WebDAV for new files |
 
 ### Processing Pipeline
-Every document goes through the following steps:
-1. **PDF Conversion**: Non-PDF files are converted to PDF format using Gotenberg
-2. **OCR Processing**: Azure Document Intelligence extracts text from images/scans
-3. **Metadata Extraction**: The configured AI provider analyzes document content to identify:
-   - Document type (invoice, receipt, contract, etc.)
-   - Key entities (dates, names, amounts, account numbers)
-   - Important data points specific to the document type
-4. **Enrichment**: Metadata is attached to the document in a structured format
+
+Each document passes through a configurable set of steps:
+
+1. **PDF Conversion** — Non-PDF files are converted using Gotenberg, with optional PDF/A archival conversion
+2. **OCR** — Text extraction via one or more OCR engines (Azure, Tesseract, EasyOCR, Mistral, Google Document AI, AWS Textract) with configurable merge strategies
+3. **AI Metadata Extraction** — The configured AI provider classifies the document and extracts structured metadata (type, dates, amounts, entities)
+4. **Enrichment** — Metadata is embedded into the PDF and stored alongside the document
+5. **Embedding Generation** — Vector embeddings for similarity search and duplicate detection
+
+Steps can be customized using **Pipelines** and **Routing Rules** for conditional processing.
 
 ### Distribution
-Processed documents with their metadata can be automatically sent to:
-- **Dropbox**: For cloud storage and sharing
-- **Nextcloud**: For self-hosted file storage
-- **Google Drive**: For Google Workspace integration
-- **Paperless-NGX**: For advanced document management with search capabilities
 
-Users can choose to send documents to any combination of these destinations through configuration settings or manual selection.
+Processed documents are distributed to any combination of configured destinations:
+
+| Destination | Type |
+|------------|------|
+| **Dropbox** | Cloud storage |
+| **Google Drive** | Cloud storage |
+| **OneDrive** | Cloud storage |
+| **Amazon S3** | Object storage |
+| **Nextcloud** | Self-hosted cloud |
+| **WebDAV** | Protocol-based |
+| **FTP / SFTP** | File transfer |
+| **iCloud Drive** | Apple cloud |
+| **Email (SMTP)** | Send as attachment |
+| **Paperless-ngx** | Document management system |
+| **Rclone** | 70+ cloud providers via Rclone |
 
 ## Features
 
-- **Intuitive File Upload**:
-  - Drag-and-drop file upload on both Upload and Files pages—upload anywhere on the Files page
-  - Real-time upload progress with validation
-  - Support for PDF, Office documents, images, and more (up to 500MB per file)
-- **Browser Extension**:
-  - Send files directly from your browser to DocuElevate with one click
-  - Compatible with Chrome, Firefox, Edge, and other Chromium-based browsers
-  - Context menu integration for quick access
-  - See [Browser Extension Guide](docs/BrowserExtension.md) for installation and usage
-- **Document Upload & Storage**:
-  - Manual uploads (via API or UI) to Dropbox, Nextcloud, Google Drive, or Paperless
-- **OCR Processing (Azure)**:
-  - Extract text from scanned PDFs using Azure Document Intelligence
-- **Metadata Extraction (AI Provider)**:
-  - Use any supported AI provider (OpenAI, Anthropic, Gemini, Ollama, etc.) to classify, label, or otherwise enrich the text with structured metadata
-- **PDF Conversion (Gotenberg)**:
-  - Convert non-PDF attachments (e.g., Word docs, images) into PDFs
-- **Document Management (Paperless NGX)**:
-  - Store processed documents and metadata in a Paperless NGX instance
-- **IMAP Integration**:
-  - Fetch documents from multiple mailboxes (including Gmail) and automatically enqueue them for processing
-- **Authentication**:
-  - Secure access to the system using **Authentik** for OAuth2-based login
+### Document Processing
+- **Multi-engine OCR** with quality checks and configurable merge strategies (AI merge, longest, primary)
+- **AI metadata extraction** using any supported provider (OpenAI, Anthropic, Gemini, Ollama, OpenRouter, Portkey, Azure OpenAI)
+- **PDF conversion** via Gotenberg with optional PDF/A archival format
+- **Duplicate detection** — exact (SHA-256) and near-duplicate (content similarity with vector embeddings)
+- **Customizable pipelines** — define multi-step processing workflows with conditional routing rules
 
-## Frameworks Used
+### Document Management
+- **Full-text search** powered by Meilisearch with saved searches
+- **File detail view** with metadata, text preview, processing history, and similarity analysis
+- **Shared links** for public document access with expiration controls
+- **Bulk operations** — reprocess, delete, or reassign documents in batch
 
-- **FastAPI**: High-performance web framework for APIs.
-- **Celery**: Task queue for asynchronous processing.
-- **Redis**: Message broker and result backend.
-- **SQLAlchemy**: ORM for database interactions.
-- **Tailwind CSS**: Utility-first CSS framework.
-- **Docker**: Containerization for easy deployment.
+### Multi-Channel Ingestion
+- **Web UI** — drag-and-drop upload with real-time progress
+- **Browser extension** — clip web pages or send files from Chrome, Firefox, Edge ([guide](docs/BrowserExtension.md))
+- **Mobile app** — iOS and Android with camera capture, push notifications, and SSO ([guide](docs/MobileApp.md))
+- **CLI tool** — batch uploads, downloads, search, and API-token management ([guide](docs/CLIGuide.md))
+- **REST API & GraphQL** — full programmatic access with Swagger documentation at `/docs`
+- **IMAP email** — poll multiple mailboxes with attachment filtering and auto-processing
+- **Watched folders** — local filesystem, FTP, SFTP, and cloud storage providers
+
+### Administration
+- **Multi-user mode** with per-user document isolation and ownership
+- **Subscription & billing** — Stripe integration with configurable plans and quotas
+- **Scheduled jobs** — IMAP polling, watched folder scans, automated backups, uptime monitoring
+- **Audit logging** with SIEM integration support
+- **Compliance templates** — GDPR, HIPAA, SOC 2
+- **Admin dashboard** — user management, queue monitoring, credential management, backup/restore
+
+### Authentication & Security
+- **Local accounts** with self-service registration and password reset
+- **OAuth2/OIDC** via Authentik or any OIDC provider
+- **Social login** — Google, Microsoft, Apple, Dropbox
+- **API tokens** for CLI, mobile, and automation access
+- **Security headers** — HSTS, CSP, X-Frame-Options, X-Content-Type-Options
+- **Rate limiting** with configurable per-endpoint controls
+
+### Notifications
+- **100+ notification backends** via Apprise — Discord, Telegram, Slack, Microsoft Teams, Email, webhooks, and more
+- **Configurable events** — task failures, credential issues, file processed, user signup, payment issues
+- **In-app notification inbox** with per-user preferences
+- **Webhooks** — push events to external systems with HMAC signature verification and retry
+
+## Tech Stack
+
+| Component | Technology |
+|-----------|-----------|
+| **Backend** | FastAPI, Celery, Redis, SQLAlchemy, Alembic |
+| **Frontend** | Jinja2, Tailwind CSS |
+| **Search** | Meilisearch |
+| **Mobile** | React Native (Expo) — iOS & Android |
+| **AI** | LiteLLM (OpenAI, Anthropic, Gemini, Ollama, OpenRouter, Portkey) |
+| **OCR** | Azure Document Intelligence, Tesseract, EasyOCR, Mistral, Google Doc AI, AWS Textract |
+| **PDF** | Gotenberg, pypdf |
+| **Auth** | Authlib (OAuth2/OIDC), MSAL, social providers |
+| **Infrastructure** | Docker, Docker Compose, Helm/Kubernetes |
+| **Docs** | MkDocs Material |
 
 ## Quick Start
 
-For detailed installation and deployment instructions, please refer to the [Deployment Guide](docs/DeploymentGuide.md).
+For detailed installation and deployment instructions, see the [Deployment Guide](docs/DeploymentGuide.md).
 
 ```bash
 # Clone the repository
@@ -147,20 +180,96 @@ cd DocuElevate
 
 # Configure environment variables
 cp .env.demo .env
-# Edit .env with your settings
+# Edit .env with your settings (see Configuration Guide for all options)
 
 # Run with Docker Compose
-docker-compose up -d
+docker compose up -d
 ```
 
-The API will be available at **`http://localhost:8000`**, and the API documentation is available at **`http://localhost:8000/docs`**.
+The web UI is available at **`http://localhost:8000`** and the interactive API documentation at **`http://localhost:8000/docs`**.
+
+### Kubernetes / Helm
+
+```bash
+helm repo add docuelevate https://christianlouis.github.io/DocuElevate
+helm install docuelevate docuelevate/docuelevate -f values.yaml
+```
+
+See the [Kubernetes Deployment Guide](docs/KubernetesDeployment.md) for full details.
+
+## Documentation
+
+### Getting Started
+
+| Guide | Description |
+|-------|-------------|
+| [Setup Wizard](docs/SetupWizard.md) | Interactive first-run setup |
+| [User Guide](docs/UserGuide.md) | How to use DocuElevate |
+| [Browser Extension](docs/BrowserExtension.md) | Install and use the browser extension |
+| [Mobile App](docs/MobileApp.md) | iOS and Android mobile app |
+| [CLI Guide](docs/CLIGuide.md) | Command-line tool for automation |
+
+### How-To Guides
+
+| Guide | Description |
+|-------|-------------|
+| [How-To Overview](docs/HowToGuides.md) | Index of all how-to guides |
+| [Email Ingestion](docs/howto/EmailIngestion.md) | Set up IMAP email polling |
+| [Watched Folder](docs/howto/WatchedFolderSetup.md) | Monitor local or remote folders |
+| [Mobile Scanning](docs/howto/MobileScanning.md) | Scan documents with your phone |
+
+### Reference
+
+| Guide | Description |
+|-------|-------------|
+| [API Documentation](docs/API.md) | REST & GraphQL API reference |
+| [Configuration Guide](docs/ConfigurationGuide.md) | All environment variables |
+| [Configuration Master](docs/ConfigurationMaster.md) | Configuration overview |
+| [Settings Management](docs/SettingsManagement.md) | Runtime settings UI |
+
+### Deployment & Operations
+
+| Guide | Description |
+|-------|-------------|
+| [Deployment Guide](docs/DeploymentGuide.md) | Docker Compose deployment |
+| [Kubernetes / Helm](docs/KubernetesDeployment.md) | Kubernetes deployment with Helm charts |
+| [Production Readiness](docs/ProductionReadiness.md) | Checklist for production environments |
+| [Database Configuration](docs/DatabaseConfiguration.md) | Database setup and migration |
+| [Backup & Restore](docs/ConfigurationGuide.md#backup--restore) | Automated backup configuration |
+
+### Storage Integration Setup
+
+| Guide | Description |
+|-------|-------------|
+| [Dropbox](docs/DropboxSetup.md) | Dropbox OAuth setup |
+| [Google Drive](docs/GoogleDriveSetup.md) | Google Drive service account / OAuth |
+| [OneDrive](docs/OneDriveSetup.md) | Microsoft OneDrive setup |
+| [Amazon S3](docs/AmazonS3Setup.md) | S3 bucket configuration |
+| [Authentication](docs/AuthenticationSetup.md) | OAuth2, OIDC, and social login |
+| [Notifications](docs/NotificationsSetup.md) | Notification backend setup |
+
+### Security & Compliance
+
+| Guide | Description |
+|-------|-------------|
+| [Credential Rotation](docs/CredentialRotationGuide.md) | Rotate secrets safely |
+| [Licensing Compliance](docs/LicensingCompliance.md) | Dependency licenses |
+| [Privacy & GDPR](docs/PrivacyCompliance.md) | Privacy compliance |
+
+### Development
+
+| Guide | Description |
+|-------|-------------|
+| [Contributing](CONTRIBUTING.md) | Code style, commits, and PR process |
+| [Troubleshooting](docs/Troubleshooting.md) | Common issues and solutions |
+| [Configuration Troubleshooting](docs/ConfigurationTroubleshooting.md) | Configuration-specific issues |
+| [Build Metadata](docs/BuildMetadata.md) | Version and build information |
+| [Internationalization](docs/InternationalizationGuide.md) | Translation and localization |
 
 ## Development & Testing
 
 ### Running Tests
 
-DocuElevate includes comprehensive test coverage. To run tests:
-
 ```bash
 # Install development dependencies
 pip install -r requirements-dev.txt
@@ -175,21 +284,21 @@ pytest --cov=app --cov-report=term-missing
 pytest -m unit
 ```
 
-Tests are automatically configured with the necessary environment variables - **no manual setup required!**
+Tests are automatically configured with the necessary environment variables — **no manual setup required!**
 
-For detailed testing information, including integration tests with Docker and authentication testing, see the [Contributing Guide](CONTRIBUTING.md#running-tests).
+For detailed testing information, see the [Contributing Guide](CONTRIBUTING.md#running-tests).
 
 ### Contributing
 
 We welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for:
-- Code style guidelines
+- Code style guidelines (Ruff for formatting and linting)
 - Commit message format (Conventional Commits)
 - Testing requirements
 - Pull request process
 
 ## License
 
-This project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.
+This project is licensed under the Apache License 2.0 — see the [LICENSE](LICENSE) file for details.
 
 ## Third-Party Software
 
@@ -214,13 +323,10 @@ The following is a summary of the licenses used by our direct dependencies:
 | Uvicorn    | BSD     |
 | SQLAlchemy | MIT     |
 | Pydantic   | MIT     |
-| openai     | MIT     |
 | litellm    | MIT     |
 | pypdf      | BSD     |
 | Requests   | Apache 2.0 |
-| puremagic  | MIT     |
-| filetype   | MIT     |
-| Dropbox    | MIT     |
+| Dropbox SDK | MIT    |
 | Azure AI Document Intelligence | MIT |
 | Authlib    | BSD     |
 | Starlette  | BSD     |
@@ -229,15 +335,15 @@ The following is a summary of the licenses used by our direct dependencies:
 | Microsoft Graph Core | MIT |
 | MSAL       | MIT     |
 | Boto3      | Apache 2.0 |
-| Paramiko   | LGPL-2.1|
+| Paramiko   | LGPL-2.1 |
 | Apprise    | MIT     |
-| Redis      | BSD     |
-| Gotenberg  | MIT     |
+| Redis (py) | BSD     |
+| Gotenberg Client | MIT |
+| Meilisearch | MIT   |
 
 For a comprehensive list of all dependencies and their licenses, run:
 
-```
+```bash
 pip install pip-licenses
 pip-licenses
-
 ```

RUNTIME_INFO

@@ -1,10 +1,10 @@
 DocuElevate Build Information
 ==============================
-Version: 0.131.0
-Build Date: 2026-03-13T14:54:25Z
-Git Commit: a47db951295c5760e66cef1741771137ccc1b666
-Git Short SHA: a47db95
+Version: 0.172.3
+Build Date: 2026-03-23T16:27:32Z
+Git Commit: 2a5296d7e7389327f46d21b3e43b1210f00b8146
+Git Short SHA: 2a5296d
 Git Branch: main
-Commit Date: 2026-03-13T15:54:02+01:00
-Build Timestamp: 2026-03-13T14:54:25Z
+Commit Date: 2026-03-23T17:27:08+01:00
+Build Timestamp: 2026-03-23T16:27:32Z
 ==============================

VERSION

@@ -1 +1 @@
-0.131.0
+0.172.3

app/api/__init__.py

@@ -33,16 +33,20 @@ from app.api.pipelines import router as pipelines_router
 from app.api.plans import router as plans_router
 from app.api.process import router as process_router
 from app.api.profile import router as profile_router
+from app.api.qr_auth import router as qr_auth_router
 from app.api.queue import router as queue_router
 from app.api.routing_rules import router as routing_rules_router
 from app.api.saved_searches import router as saved_searches_router
 from app.api.scheduled_jobs import router as scheduled_jobs_router
 from app.api.search import router as search_router
+from app.api.sessions import router as sessions_router
 from app.api.settings import router as settings_router
 from app.api.shared_links import public_router as shared_links_public_router
 from app.api.shared_links import router as shared_links_router
 from app.api.similarity import router as similarity_router
 from app.api.subscriptions import router as subscriptions_router
+from app.api.system_reset import router as system_reset_router
+from app.api.translation import router as translation_router
 from app.api.url_upload import router as url_upload_router
 
 # Import all the individual routers
@@ -95,4 +99,8 @@ router.include_router(scheduled_jobs_router)
 router.include_router(audit_logs_router)
 router.include_router(i18n_router)
 router.include_router(mobile_router)
+router.include_router(sessions_router)
+router.include_router(qr_auth_router)
 router.include_router(compliance_router)
+router.include_router(system_reset_router)
+router.include_router(translation_router)

app/api/api_tokens.py

@@ -42,6 +42,9 @@ TOKEN_HASH_ITERATIONS = 100_000
 #: PBKDF2 salt for API token hashing (not secret, but fixed for determinism).
 TOKEN_HASH_SALT = b"api-token-v1"
 
+#: Name prefix used for tokens created by the mobile app flow.
+MOBILE_TOKEN_PREFIX = "Mobile App"
+
 
 # ---------------------------------------------------------------------------
 # Auth helper
@@ -91,6 +94,20 @@ def hash_token(token: str) -> str:
     return dk.hex()
 
 
+def _token_to_dict(t: ApiToken) -> dict[str, Any]:
+    """Convert an ``ApiToken`` ORM instance to a serialisable dict."""
+    return {
+        "id": t.id,
+        "name": t.name,
+        "token_prefix": t.token_prefix,
+        "is_active": t.is_active,
+        "last_used_at": t.last_used_at,
+        "last_used_ip": t.last_used_ip,
+        "created_at": t.created_at,
+        "revoked_at": t.revoked_at,
+    }
+
+
 # ---------------------------------------------------------------------------
 # Pydantic schemas
 # ---------------------------------------------------------------------------
@@ -177,21 +194,44 @@ async def list_tokens(
     owner_id: CurrentOwner,
     db: DbSession,
 ) -> list[dict[str, Any]]:
-    """List all API tokens for the authenticated user."""
-    tokens = db.query(ApiToken).filter(ApiToken.owner_id == owner_id).order_by(ApiToken.created_at.desc()).all()
-    return [
-        {
-            "id": t.id,
-            "name": t.name,
-            "token_prefix": t.token_prefix,
-            "is_active": t.is_active,
-            "last_used_at": t.last_used_at,
-            "last_used_ip": t.last_used_ip,
-            "created_at": t.created_at,
-            "revoked_at": t.revoked_at,
-        }
-        for t in tokens
-    ]
+    """List non-mobile API tokens for the authenticated user.
+
+    Mobile tokens (whose names start with ``"Mobile App"``) are excluded
+    from this list; they are managed on the dedicated Devices page via
+    ``GET /api/api-tokens/mobile``.
+    """
+    tokens = (
+        db.query(ApiToken)
+        .filter(
+            ApiToken.owner_id == owner_id,
+            ~ApiToken.name.startswith(MOBILE_TOKEN_PREFIX),
+        )
+        .order_by(ApiToken.created_at.desc())
+        .all()
+    )
+    return [_token_to_dict(t) for t in tokens]
+
+
+@router.get("/mobile", response_model=list[TokenResponse])
+async def list_mobile_tokens(
+    owner_id: CurrentOwner,
+    db: DbSession,
+) -> list[dict[str, Any]]:
+    """List mobile API tokens for the authenticated user.
+
+    Returns tokens whose names start with ``"Mobile App"`` — these are
+    created via the mobile SSO flow or QR code login.
+    """
+    tokens = (
+        db.query(ApiToken)
+        .filter(
+            ApiToken.owner_id == owner_id,
+            ApiToken.name.startswith(MOBILE_TOKEN_PREFIX),
+        )
+        .order_by(ApiToken.created_at.desc())
+        .all()
+    )
+    return [_token_to_dict(t) for t in tokens]
 
 
 @router.delete("/{token_id}", status_code=status.HTTP_200_OK)

app/api/audit_logs.py

@@ -7,7 +7,7 @@ Events are append-only — there are no update or delete endpoints.
 
 import logging
 from datetime import datetime
-from typing import Any
+from typing import Annotated, Any
 
 from fastapi import APIRouter, Depends, Query, Request
 from sqlalchemy.orm import Session
@@ -20,20 +20,22 @@ logger = logging.getLogger(__name__)
 
 router = APIRouter()
 
+DbSession = Annotated[Session, Depends(get_db)]
+
 
 @router.get("/audit-logs")
 @require_login
 async def list_audit_logs(
     request: Request,
-    db: Session = Depends(get_db),
-    action: str | None = Query(None, description="Filter by action (exact match)"),
-    user: str | None = Query(None, description="Filter by username"),
-    resource_type: str | None = Query(None, description="Filter by resource type"),
-    severity: str | None = Query(None, description="Filter by severity level"),
-    since: datetime | None = Query(None, description="Only events at or after this ISO-8601 timestamp"),
-    until: datetime | None = Query(None, description="Only events at or before this ISO-8601 timestamp"),
-    limit: int = Query(50, ge=1, le=500, description="Max rows to return"),
-    offset: int = Query(0, ge=0, description="Rows to skip for pagination"),
+    db: DbSession,
+    action: Annotated[str | None, Query(description="Filter by action (exact match)")] = None,
+    user: Annotated[str | None, Query(description="Filter by username")] = None,
+    resource_type: Annotated[str | None, Query(description="Filter by resource type")] = None,
+    severity: Annotated[str | None, Query(description="Filter by severity level")] = None,
+    since: Annotated[datetime | None, Query(description="Only events at or after this ISO-8601 timestamp")] = None,
+    until: Annotated[datetime | None, Query(description="Only events at or before this ISO-8601 timestamp")] = None,
+    limit: Annotated[int, Query(ge=1, le=500, description="Max rows to return")] = 50,
+    offset: Annotated[int, Query(ge=0, description="Rows to skip for pagination")] = 0,
 ) -> dict[str, Any]:
     """Return audit log entries with optional filtering and pagination.
 
@@ -71,7 +73,7 @@ async def list_audit_logs(
 @require_login
 async def list_distinct_actions(
     request: Request,
-    db: Session = Depends(get_db),
+    db: DbSession,
 ) -> list[str]:
     """Return the distinct action values present in the audit log."""
     from app.models import AuditLog
@@ -84,7 +86,7 @@ async def list_distinct_actions(
 @require_login
 async def list_distinct_users(
     request: Request,
-    db: Session = Depends(get_db),
+    db: DbSession,
 ) -> list[str]:
     """Return the distinct user values present in the audit log."""
     from app.models import AuditLog

app/api/billing.py

@@ -168,9 +168,8 @@ async def create_checkout_session(
     checkout_session = client.checkout.sessions.create(params=session_params)
 
     logger.info(
-        "Created Stripe checkout session %s for user %s plan %s",
+        "Created Stripe checkout session %s for plan %s",
         checkout_session.id,
-        owner_id,
         body.plan_id,
     )
     return {"checkout_url": checkout_session.url, "session_id": checkout_session.id}
@@ -213,7 +212,7 @@ async def create_portal_session(
         }
     )
 
-    logger.info("Created Stripe portal session for user %s", owner_id)
+    logger.info("Created Stripe portal session for user")
     return {"portal_url": portal.url}
 
 

app/api/dropbox.py

@@ -6,7 +6,7 @@ import logging
 import os
 from typing import Annotated, Optional
 
-import requests
+import httpx
 from fastapi import APIRouter, Depends, Form, HTTPException, Request, status
 from sqlalchemy.orm import Session
 
@@ -14,7 +14,7 @@ from app.auth import require_login
 from app.config import settings
 from app.database import get_db
 from app.utils.oauth_helper import exchange_oauth_token
-from app.utils.settings_service import save_setting_to_db
+from app.utils.settings_service import save_setting_to_db, update_env_file
 from app.utils.settings_sync import notify_settings_updated
 
 # Set up logging
@@ -23,6 +23,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Dependency to ensure the current user is an admin."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 @router.post("/dropbox/exchange-token")
 @require_login
 async def exchange_dropbox_token(
@@ -132,57 +143,60 @@ async def test_dropbox_token(request: Request):
                 "message": "Dropbox credentials are not fully configured",
             }
 
-        # Check token validity by getting current account info
-        headers = {"Authorization": f"Bearer {settings.dropbox_refresh_token}"}
-        response = requests.post(
-            "https://api.dropboxapi.com/2/users/get_current_account",
-            headers=headers,
-            timeout=settings.http_request_timeout,
-        )
-
-        # If token is invalid, try refreshing it
-        if response.status_code == 401:
-            logger.info("Dropbox access token invalid or expired, trying to refresh")
-
-            # Get a new access token using the refresh token
-            refresh_url = "https://api.dropbox.com/oauth2/token"
-            refresh_data = {
-                "grant_type": "refresh_token",
-                "refresh_token": settings.dropbox_refresh_token,
-                "client_id": settings.dropbox_app_key,
-                "client_secret": settings.dropbox_app_secret,
-            }
-
-            refresh_response = requests.post(refresh_url, data=refresh_data, timeout=settings.http_request_timeout)
-
-            if refresh_response.status_code != 200:
-                logger.error(f"Failed to refresh Dropbox token: {refresh_response.text}")
-                return {
-                    "status": "error",
-                    "message": "Refresh token has expired or is invalid",
-                    "needs_reauth": True,
-                }
-
-            token_info = refresh_response.json()
-            access_token = token_info.get("access_token")
-
-            # Try again with the new access token
-            headers = {"Authorization": f"Bearer {access_token}"}
-            response = requests.post(
+        async with httpx.AsyncClient() as client:
+            # Check token validity by getting current account info
+            headers = {"Authorization": f"Bearer {settings.dropbox_refresh_token}"}
+            response = await client.post(
                 "https://api.dropboxapi.com/2/users/get_current_account",
                 headers=headers,
                 timeout=settings.http_request_timeout,
             )
 
-        if response.status_code != 200:
-            logger.error(f"Dropbox token test failed: {response.status_code} {response.text}")
-            return {
-                "status": "error",
-                "message": f"Token validation failed with status {response.status_code}: {response.text}",
-            }
+            # If token is invalid, try refreshing it
+            if response.status_code == 401:
+                logger.info("Dropbox access token invalid or expired, trying to refresh")
 
-        # Get account info
-        account_info = response.json()
+                # Get a new access token using the refresh token
+                refresh_url = "https://api.dropbox.com/oauth2/token"
+                refresh_data = {
+                    "grant_type": "refresh_token",
+                    "refresh_token": settings.dropbox_refresh_token,
+                    "client_id": settings.dropbox_app_key,
+                    "client_secret": settings.dropbox_app_secret,
+                }
+
+                refresh_response = await client.post(
+                    refresh_url, data=refresh_data, timeout=settings.http_request_timeout
+                )
+
+                if refresh_response.status_code != 200:
+                    logger.error(f"Failed to refresh Dropbox token: {refresh_response.text}")
+                    return {
+                        "status": "error",
+                        "message": "Refresh token has expired or is invalid",
+                        "needs_reauth": True,
+                    }
+
+                token_info = refresh_response.json()
+                access_token = token_info.get("access_token")
+
+                # Try again with the new access token
+                headers = {"Authorization": f"Bearer {access_token}"}
+                response = await client.post(
+                    "https://api.dropboxapi.com/2/users/get_current_account",
+                    headers=headers,
+                    timeout=settings.http_request_timeout,
+                )
+
+            if response.status_code != 200:
+                logger.error(f"Dropbox token test failed: {response.status_code} {response.text}")
+                return {
+                    "status": "error",
+                    "message": f"Token validation failed with status {response.status_code}: {response.text}",
+                }
+
+            # Get account info
+            account_info = response.json()
         account_email = account_info.get("email", "Unknown account")
         account_name = account_info.get("name", {}).get("display_name", "Unknown user")
 
@@ -208,9 +222,9 @@ async def test_dropbox_token(request: Request):
 
 
 @router.post("/dropbox/save-settings")
-@require_login
 async def save_dropbox_settings(
     request: Request,
+    _admin: AdminUser,
     refresh_token: Annotated[str, Form(...)],
     app_key: Annotated[Optional[str], Form()] = None,
     app_secret: Annotated[Optional[str], Form()] = None,
@@ -249,44 +263,16 @@ async def save_dropbox_settings(
         # Best-effort .env file write
         try:
             env_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), ".env")
-            if not os.path.exists(env_path):
-                logger.warning(f".env file not found at {env_path}, skipping file write")
-            else:
-                logger.info(f"Updating Dropbox settings in {env_path}")
+            dropbox_settings = {"DROPBOX_REFRESH_TOKEN": refresh_token}
+            if app_key:
+                dropbox_settings["DROPBOX_APP_KEY"] = app_key
+            if app_secret:
+                dropbox_settings["DROPBOX_APP_SECRET"] = app_secret
+            if folder_path:
+                dropbox_settings["DROPBOX_FOLDER"] = folder_path
 
-                with open(env_path, "r") as f:
-                    env_lines = f.readlines()
-
-                dropbox_settings = {"DROPBOX_REFRESH_TOKEN": refresh_token}
-                if app_key:
-                    dropbox_settings["DROPBOX_APP_KEY"] = app_key
-                if app_secret:
-                    dropbox_settings["DROPBOX_APP_SECRET"] = app_secret
-                if folder_path:
-                    dropbox_settings["DROPBOX_FOLDER"] = folder_path
-
-                updated = set()
-                new_env_lines = []
-                for line in env_lines:
-                    stripped_line = line.rstrip()
-                    is_updated = False
-                    for key, value in dropbox_settings.items():
-                        if stripped_line.startswith(f"{key}=") or stripped_line.startswith(f"# {key}="):
-                            new_env_lines.append(f"{key}={value}")
-                            updated.add(key)
-                            is_updated = True
-                            break
-                    if not is_updated:
-                        new_env_lines.append(stripped_line)
-
-                for key, value in dropbox_settings.items():
-                    if key not in updated:
-                        new_env_lines.append(f"{key}={value}")
-
-                with open(env_path, "w") as f:
-                    f.write("\n".join(new_env_lines) + "\n")
-
-                logger.info("Successfully updated Dropbox settings in .env file")
+            if not update_env_file(env_path, dropbox_settings):
+                logger.info("Continuing with in-memory update despite .env file update failure or skip")
         except Exception as env_err:
             logger.warning(f"Failed to write .env file (non-fatal): {env_err}")
 

app/api/duplicates.py

@@ -73,33 +73,38 @@ def list_duplicate_groups(
     groups = []
     total_duplicate_files = 0
 
-    for filehash in dup_hashes:
-        # Find the original (non-duplicate) record with this hash
-        original = (
-            db.query(FileRecord)
-            .filter(FileRecord.filehash == filehash, FileRecord.is_duplicate.is_(False))
-            .order_by(FileRecord.id.asc())
-            .first()
+    if dup_hashes:
+        # Fetch all matching files (both original and duplicates) in a single batch query
+        all_records = (
+            db.query(FileRecord).filter(FileRecord.filehash.in_(dup_hashes)).order_by(FileRecord.id.asc()).all()
         )
 
-        # Find all duplicate records for this hash
-        duplicates = (
-            db.query(FileRecord)
-            .filter(FileRecord.filehash == filehash, FileRecord.is_duplicate.is_(True))
-            .order_by(FileRecord.id.asc())
-            .all()
-        )
+        # Group records by hash
+        originals_by_hash = {}
+        duplicates_by_hash = {h: [] for h in dup_hashes}
 
-        total_duplicate_files += len(duplicates)
+        for record in all_records:
+            h = record.filehash
+            if not record.is_duplicate:
+                # Store only the first original record per hash, matching the old .first() behaviour
+                if h not in originals_by_hash:
+                    originals_by_hash[h] = record
+            else:
+                duplicates_by_hash[h].append(record)
+                total_duplicate_files += 1
 
-        groups.append(
-            {
-                "filehash": filehash,
-                "original": _file_record_to_dict(original) if original else None,
-                "duplicates": [_file_record_to_dict(d) for d in duplicates],
-                "duplicate_count": len(duplicates),
-            }
-        )
+        for filehash in dup_hashes:
+            original = originals_by_hash.get(filehash)
+            duplicates = duplicates_by_hash.get(filehash, [])
+
+            groups.append(
+                {
+                    "filehash": filehash,
+                    "original": _file_record_to_dict(original) if original else None,
+                    "duplicates": [_file_record_to_dict(d) for d in duplicates],
+                    "duplicate_count": len(duplicates),
+                }
+            )
 
     total_pages = (total_groups + per_page - 1) // per_page if total_groups > 0 else 1
 

app/api/files.py

@@ -11,6 +11,7 @@ import zipfile
 from datetime import datetime, timezone
 from typing import Annotated, List, Optional
 
+import aiofiles
 from fastapi import APIRouter, Depends, File, HTTPException, Query, Request, UploadFile, status
 from fastapi.responses import StreamingResponse
 from sqlalchemy import asc, desc
@@ -345,7 +346,9 @@ def bulk_delete_files(request: Request, file_ids: List[int], db: DbSession):
 
     try:
         # Find all file records
-        file_records = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)).all()
+        query = db.query(FileRecord).filter(FileRecord.id.in_(file_ids))
+        query = apply_owner_filter(query, request)
+        file_records = query.all()
 
         if not file_records:
             raise HTTPException(status_code=404, detail="No files found with the provided IDs")
@@ -384,7 +387,9 @@ def bulk_reprocess_files(request: Request, file_ids: List[int], db: DbSession):
     """
     try:
         # Find all file records
-        file_records = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)).all()
+        query = db.query(FileRecord).filter(FileRecord.id.in_(file_ids))
+        query = apply_owner_filter(query, request)
+        file_records = query.all()
 
         if not file_records:
             raise HTTPException(status_code=404, detail="No files found with the provided IDs")
@@ -456,7 +461,9 @@ def bulk_reprocess_files_cloud_ocr(request: Request, file_ids: List[int], db: Db
     Useful for re-running OCR on files with poor text quality or missing OCR text.
     """
     try:
-        file_records = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)).all()
+        query = db.query(FileRecord).filter(FileRecord.id.in_(file_ids))
+        query = apply_owner_filter(query, request)
+        file_records = query.all()
 
         if not file_records:
             raise HTTPException(status_code=404, detail="No files found with the provided IDs")
@@ -536,7 +543,9 @@ def bulk_download_files(request: Request, file_ids: List[int], db: DbSession):
     Files not found on disk are silently skipped.
     """
     try:
-        file_records = db.query(FileRecord).filter(FileRecord.id.in_(file_ids)).all()
+        query = db.query(FileRecord).filter(FileRecord.id.in_(file_ids))
+        query = apply_owner_filter(query, request)
+        file_records = query.all()
 
         if not file_records:
             raise HTTPException(status_code=404, detail="No files found with the provided IDs")
@@ -618,7 +627,9 @@ def reprocess_single_file(request: Request, file_id: int, db: DbSession):
     """
     try:
         # Find the file record
-        file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first()
+        query = db.query(FileRecord).filter(FileRecord.id == file_id)
+        query = apply_owner_filter(query, request)
+        file_record = query.first()
 
         if not file_record:
             raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found")
@@ -674,7 +685,9 @@ def reprocess_with_cloud_ocr(request: Request, file_id: int, db: DbSession):
     """
     try:
         # Find the file record
-        file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first()
+        query = db.query(FileRecord).filter(FileRecord.id == file_id)
+        query = apply_owner_filter(query, request)
+        file_record = query.first()
 
         if not file_record:
             raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found")
@@ -937,7 +950,9 @@ def retry_subtask(
     """
     try:
         # Find the file record
-        file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first()
+        query = db.query(FileRecord).filter(FileRecord.id == file_id)
+        query = apply_owner_filter(query, request)
+        file_record = query.first()
 
         if not file_record:
             raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found")
@@ -1079,7 +1094,9 @@ def get_file_preview(
 
     try:
         # Find the file record
-        file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first()
+        query = db.query(FileRecord).filter(FileRecord.id == file_id)
+        query = apply_owner_filter(query, request)
+        file_record = query.first()
 
         if not file_record:
             raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found")
@@ -1159,7 +1176,9 @@ def download_file(
 
     try:
         # Find the file record
-        file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first()
+        query = db.query(FileRecord).filter(FileRecord.id == file_id)
+        query = apply_owner_filter(query, request)
+        file_record = query.first()
 
         if not file_record:
             raise HTTPException(status_code=404, detail=f"File with ID {file_id} not found")
@@ -1217,6 +1236,66 @@ def download_file(
         raise HTTPException(status_code=500, detail=f"Error downloading file: {str(e)}")
 
 
+async def _save_upload_file_chunks(file: UploadFile, target_path: str, max_size: int) -> int:
+    """Save an uploaded file in chunks and enforce the maximum size limit."""
+    try:
+        written_size = 0
+        with open(target_path, "wb") as f:
+            chunk_size = 65536  # 64 KB chunks
+            while True:
+                chunk = await file.read(chunk_size)
+                if not chunk:
+                    break
+                written_size += len(chunk)
+                if written_size > max_size:
+                    # Exceeded limit mid-stream; clean up and reject
+                    f.close()
+                    os.remove(target_path)
+                    raise HTTPException(
+                        status_code=413,
+                        detail=f"File too large: exceeded {max_size} bytes during upload. "
+                        f"See SECURITY_AUDIT.md for configuration details.",
+                    )
+                f.write(chunk)
+        return written_size
+    except HTTPException:
+        raise
+    except Exception as e:
+        if os.path.exists(target_path):
+            os.remove(target_path)
+        raise HTTPException(status_code=500, detail=f"Failed to save file: {e}")
+
+
+def _check_for_exact_duplicate(db: DbSession, target_path: str, safe_filename: str) -> dict | None:
+    """Check for an exact duplicate of the uploaded file and return a warning if found."""
+    if not settings.enable_deduplication:
+        return None
+
+    try:
+        filehash = hash_file(target_path)
+        existing = (
+            db.query(FileRecord)
+            .filter(FileRecord.filehash == filehash, FileRecord.is_duplicate.is_(False))
+            .order_by(FileRecord.id.asc())
+            .first()
+        )
+        if existing:
+            logger.info(f"Exact duplicate detected on upload: '{safe_filename}' matches file ID {existing.id}")
+            return {
+                "duplicate_type": "exact",
+                "original_file_id": existing.id,
+                "original_filename": existing.original_filename,
+                "message": (
+                    "This file appears to be an exact duplicate of an already-processed document. "
+                    "It will still be queued but will be flagged as a duplicate."
+                ),
+            }
+    except Exception as e:
+        logger.warning(f"Duplicate check failed for uploaded file '{safe_filename}': {e}")
+
+    return None
+
+
 @router.post("/ui-upload")
 @require_login
 async def ui_upload(request: Request, db: DbSession, file: UploadFile = File(...)):
@@ -1277,7 +1356,7 @@ async def ui_upload(request: Request, db: DbSession, file: UploadFile = File(...
     # enforcing the size limit during the read so memory usage stays bounded.
     try:
         written_size = 0
-        with open(target_path, "wb") as f:
+        async with aiofiles.open(target_path, "wb") as f:
             chunk_size = 65536  # 64 KB chunks
             while True:
                 chunk = await file.read(chunk_size)
@@ -1286,14 +1365,14 @@ async def ui_upload(request: Request, db: DbSession, file: UploadFile = File(...
                 written_size += len(chunk)
                 if written_size > max_size:
                     # Exceeded limit mid-stream; clean up and reject
-                    f.close()
+                    await f.close()
                     os.remove(target_path)
                     raise HTTPException(
                         status_code=413,
                         detail=f"File too large: exceeded {max_size} bytes during upload. "
                         f"See SECURITY_AUDIT.md for configuration details.",
                     )
-                f.write(chunk)
+                await f.write(chunk)
     except HTTPException:
         raise
     except Exception as e:
@@ -1384,29 +1463,7 @@ async def ui_upload(request: Request, db: DbSession, file: UploadFile = File(...
     # Check for exact duplicates (same SHA-256 hash) before returning.
     # This gives the caller an immediate warning without waiting for the pipeline.
     # Only performed when deduplication is enabled in settings.
-    exact_duplicate_warning = None
-    if settings.enable_deduplication:
-        try:
-            filehash = hash_file(target_path)
-            existing = (
-                db.query(FileRecord)
-                .filter(FileRecord.filehash == filehash, FileRecord.is_duplicate.is_(False))
-                .order_by(FileRecord.id.asc())
-                .first()
-            )
-            if existing:
-                exact_duplicate_warning = {
-                    "duplicate_type": "exact",
-                    "original_file_id": existing.id,
-                    "original_filename": existing.original_filename,
-                    "message": (
-                        "This file appears to be an exact duplicate of an already-processed document. "
-                        "It will still be queued but will be flagged as a duplicate."
-                    ),
-                }
-                logger.info(f"Exact duplicate detected on upload: '{safe_filename}' matches file ID {existing.id}")
-        except Exception as e:
-            logger.warning(f"Duplicate check failed for uploaded file '{safe_filename}': {e}")
+    exact_duplicate_warning = _check_for_exact_duplicate(db, target_path, safe_filename)
 
     response: dict = {
         "task_id": task.id,
@@ -1458,7 +1515,7 @@ def claim_file(request: Request, file_id: int, db: DbSession):
         logger.exception(f"Error claiming file {file_id}: {e}")
         raise HTTPException(status_code=500, detail="Failed to claim document")
 
-    logger.info(f"File {file_id} claimed by user '{owner_id}'")
+    logger.info("File %d claimed by user", file_id)
     return {"status": "success", "message": "Document claimed successfully", "file_id": file_id, "owner_id": owner_id}
 
 
@@ -1498,7 +1555,7 @@ def bulk_claim_files(request: Request, file_ids: list[int], db: DbSession):
         logger.exception(f"Error during bulk claim: {e}")
         raise HTTPException(status_code=500, detail="Failed to claim documents")
 
-    logger.info(f"Bulk claim by '{owner_id}': claimed={claimed}, skipped={[s['file_id'] for s in skipped]}")
+    logger.info("Bulk claim: claimed=%s, skipped=%s", claimed, [s["file_id"] for s in skipped])
     return {
         "status": "success",
         "claimed_count": len(claimed),
@@ -1551,8 +1608,7 @@ def assign_owner(request: Request, db: DbSession, owner_id: str = Query(...), fi
         logger.exception(f"Error assigning owner: {e}")
         raise HTTPException(status_code=500, detail="Failed to assign owner")
 
-    admin_name = get_current_owner_id(request) or "admin"
-    logger.info(f"Admin '{admin_name}' assigned owner_id='{owner_id}' to {updated} file(s)")
+    logger.info("Admin assigned owner to %d file(s)", updated)
     return {
         "status": "success",
         "message": f"Assigned owner to {updated} document(s)",

app/api/google_drive.py

@@ -14,7 +14,7 @@ from app.auth import require_login
 from app.config import settings
 from app.database import get_db
 from app.utils.oauth_helper import exchange_oauth_token
-from app.utils.settings_service import save_setting_to_db
+from app.utils.settings_service import save_setting_to_db, update_env_file
 from app.utils.settings_sync import notify_settings_updated
 
 # Set up logging
@@ -23,6 +23,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Dependency to ensure the current user is an admin."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 @router.post("/google-drive/exchange-token")
 @require_login
 async def exchange_google_drive_token(
@@ -362,9 +373,9 @@ def format_time_remaining(time_delta):
 
 
 @router.post("/google-drive/save-settings")
-@require_login
-async def save_dropbox_settings(
+async def save_google_drive_settings(
     request: Request,
+    _admin: AdminUser,
     refresh_token: Annotated[str, Form(...)],
     client_id: Annotated[Optional[str], Form()] = None,
     client_secret: Annotated[Optional[str], Form()] = None,
@@ -404,46 +415,9 @@ async def save_dropbox_settings(
             drive_settings["GOOGLE_DRIVE_FOLDER_ID"] = folder_id
 
         # Try to update the .env file, but don't fail if it doesn't exist (for Docker containers)
-        if os.path.exists(env_path):
-            try:
-                logger.info(f"Updating Google Drive settings in {env_path}")
-
-                # Read the current .env file
-                with open(env_path, "r") as f:
-                    env_lines = f.readlines()
-
-                # Process each line and update or add settings
-                updated = set()
-                new_env_lines = []
-                for line in env_lines:
-                    stripped_line = line.rstrip()
-                    is_updated = False
-                    for key, value in drive_settings.items():
-                        if stripped_line.startswith(f"{key}=") or stripped_line.startswith(f"# {key}="):
-                            # Uncomment if commented out - check the original stripped line
-                            new_env_lines.append(f"{key}={value}")
-                            updated.add(key)
-                            is_updated = True
-                            break
-                    if not is_updated:
-                        new_env_lines.append(stripped_line)
-
-                # Add any settings that weren't updated (they weren't in the file)
-                for key, value in drive_settings.items():
-                    if key not in updated:
-                        new_env_lines.append(f"{key}={value}")
-
-                # Write the updated .env file
-                with open(env_path, "w") as f:
-                    f.write("\n".join(new_env_lines) + "\n")
-
-                logger.info("Successfully updated Google Drive settings in .env file")
-            except Exception as e:
-                logger.warning(f"Failed to update .env file: {str(e)}, but will continue with in-memory update")
-        else:
-            logger.warning(
-                f".env file not found at {env_path}, skipping file update but continuing with in-memory update"
-            )
+        env_write_success = update_env_file(env_path, drive_settings)
+        if not env_write_success:
+            logger.info("Continuing with in-memory update despite .env file update failure or skip")
 
         # Update the settings in memory (this always happens)
         if refresh_token:
@@ -481,7 +455,7 @@ async def save_dropbox_settings(
         return {
             "status": "success",
             "message": "Google Drive settings have been saved",
-            "in_memory_only": not os.path.exists(env_path),
+            "in_memory_only": not env_write_success,
         }
 
     except Exception as e:

app/api/imap_accounts.py

@@ -17,6 +17,7 @@ from sqlalchemy.orm import Session
 from app.database import get_db
 from app.models import UserImapAccount
 from app.utils.encryption import decrypt_value, encrypt_value
+from app.utils.network import is_private_ip
 from app.utils.subscription import get_tier, get_user_tier_id
 from app.utils.user_scope import get_current_owner_id
 
@@ -187,6 +188,11 @@ def _test_imap_connection(host: str, port: int, username: str, password: str, us
 
     Returns a dict with ``{"success": bool, "message": str}``.
     """
+
+    # Security: Prevent SSRF by blocking connections to internal IPs
+    if is_private_ip(host):
+        logger.warning("SSRF blocked: Attempt to connect to private IP %s", host)
+        return {"success": False, "message": "Connection error: Invalid hostname or IP address"}
     try:
         if use_ssl:
             mail = imaplib.IMAP4_SSL(host, port)

app/api/integrations.py

@@ -564,7 +564,6 @@ def _test_webdav_connection(config: dict[str, Any] | None, credentials: dict[str
         return {"success": False, "message": "Missing required field: url"}
 
     # Only allow http/https to prevent file:// or other custom scheme attacks
-    import ipaddress
     from urllib.parse import urlparse
 
     parsed = urlparse(url)
@@ -574,14 +573,10 @@ def _test_webdav_connection(config: dict[str, Any] | None, credentials: dict[str
     # Block requests to private/internal IPs to prevent SSRF
     hostname = parsed.hostname or ""
     if hostname:
-        try:
-            addr = ipaddress.ip_address(hostname)
-            if addr.is_private or addr.is_loopback or addr.is_link_local:
-                return {"success": False, "message": "URLs pointing to internal or private networks are not allowed"}
-        except ValueError:
-            # Hostname is not an IP literal — allow DNS names through
-            if hostname in ("localhost", "localhost.localdomain"):
-                return {"success": False, "message": "URLs pointing to localhost are not allowed"}
+        from app.utils.network import is_private_ip
+
+        if is_private_ip(hostname):
+            return {"success": False, "message": "URLs pointing to internal or private networks are not allowed"}
 
     try:
         import base64

app/api/notifications.py

@@ -452,17 +452,16 @@ async def update_preferences(
             )
 
     try:
+        # Pre-fetch existing preferences for this user to avoid N+1 queries
+        existing_prefs = (
+            db.query(UserNotificationPreference).filter(UserNotificationPreference.owner_id == owner_id).all()
+        )
+
+        # Build a fast lookup dictionary keyed by (event_type, channel_type, target_id)
+        prefs_dict = {(pref.event_type, pref.channel_type, pref.target_id): pref for pref in existing_prefs}
+
         for item in body.preferences:
-            existing = (
-                db.query(UserNotificationPreference)
-                .filter(
-                    UserNotificationPreference.owner_id == owner_id,
-                    UserNotificationPreference.event_type == item.event_type,
-                    UserNotificationPreference.channel_type == item.channel_type,
-                    UserNotificationPreference.target_id == item.target_id,
-                )
-                .first()
-            )
+            existing = prefs_dict.get((item.event_type, item.channel_type, item.target_id))
             if existing:
                 existing.is_enabled = item.is_enabled
             else:

app/api/onedrive.py

@@ -7,7 +7,7 @@ import os
 from datetime import datetime, timedelta
 from typing import Annotated, Optional
 
-import requests
+import httpx
 from fastapi import APIRouter, Depends, Form, HTTPException, Request, status
 from sqlalchemy.orm import Session
 
@@ -15,7 +15,7 @@ from app.auth import require_login
 from app.config import settings
 from app.database import get_db
 from app.utils.oauth_helper import exchange_oauth_token
-from app.utils.settings_service import save_setting_to_db
+from app.utils.settings_service import save_setting_to_db, update_env_file
 from app.utils.settings_sync import notify_settings_updated
 
 # Set up logging
@@ -24,6 +24,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Dependency to ensure the current user is an admin."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 @router.post("/onedrive/exchange-token")
 @require_login
 async def exchange_onedrive_token(
@@ -92,17 +103,18 @@ async def test_onedrive_token(request: Request):
             "scope": "offline_access Files.ReadWrite",
         }
 
-        response = requests.post(token_url, data=refresh_data, timeout=settings.http_request_timeout)
+        async with httpx.AsyncClient(timeout=settings.http_request_timeout) as client:
+            response = await client.post(token_url, data=refresh_data)
 
-        if response.status_code != 200:
-            logger.error(f"Failed to refresh OneDrive token: {response.text}")
-            return {
-                "status": "error",
-                "message": "Refresh token has expired or is invalid",
-                "needs_reauth": True,
-            }
+            if response.status_code != 200:
+                logger.error(f"Failed to refresh OneDrive token: {response.text}")
+                return {
+                    "status": "error",
+                    "message": "Refresh token has expired or is invalid",
+                    "needs_reauth": True,
+                }
 
-        token_data = response.json()
+            token_data = response.json()
         access_token = token_data.get("access_token")
         expires_in = token_data.get("expires_in", 3600)  # Default to 1 hour if not specified
 
@@ -115,32 +127,7 @@ async def test_onedrive_token(request: Request):
             settings.onedrive_refresh_token = new_refresh_token
 
             # Also try to update .env file if it exists
-            try:
-                env_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), ".env")
-                if os.path.exists(env_path):
-                    with open(env_path, "r") as f:
-                        env_lines = f.readlines()
-
-                    updated_lines = []
-                    updated = False
-
-                    for line in env_lines:
-                        if line.startswith("ONEDRIVE_REFRESH_TOKEN="):
-                            updated_lines.append(f"ONEDRIVE_REFRESH_TOKEN={new_refresh_token}\n")
-                            updated = True
-                        else:
-                            updated_lines.append(line)
-
-                    if not updated:
-                        updated_lines.append(f"ONEDRIVE_REFRESH_TOKEN={new_refresh_token}\n")
-
-                    with open(env_path, "w") as f:
-                        f.writelines(updated_lines)
-
-                    logger.info("Updated refresh token in .env file")
-
-            except Exception as e:
-                logger.warning(f"Failed to update refresh token in .env file: {e}")
+            update_env_file({"ONEDRIVE_REFRESH_TOKEN": new_refresh_token})
 
             # Persist the rotated refresh token to the database
             try:
@@ -164,17 +151,18 @@ async def test_onedrive_token(request: Request):
         user_info_url = "https://graph.microsoft.com/v1.0/me"
         headers = {"Authorization": f"Bearer {access_token}"}
 
-        user_response = requests.get(user_info_url, headers=headers, timeout=settings.http_request_timeout)
+        async with httpx.AsyncClient(timeout=settings.http_request_timeout) as client:
+            user_response = await client.get(user_info_url, headers=headers)
 
-        if user_response.status_code != 200:
-            logger.error(f"OneDrive token test failed: {user_response.status_code} {user_response.text}")
-            return {
-                "status": "error",
-                "message": f"Token validation failed with status {user_response.status_code}: {user_response.text}",
-            }
+            if user_response.status_code != 200:
+                logger.error(f"OneDrive token test failed: {user_response.status_code} {user_response.text}")
+                return {
+                    "status": "error",
+                    "message": f"Token validation failed with status {user_response.status_code}: {user_response.text}",
+                }
 
-        # Get user info
-        user_info = user_response.json()
+            # Get user info
+            user_info = user_response.json()
         display_name = user_info.get("displayName", "Unknown user")
         email = user_info.get("userPrincipalName", "Unknown email")
 
@@ -227,9 +215,9 @@ def format_time_remaining(time_delta):
 
 
 @router.post("/onedrive/save-settings")
-@require_login
 async def save_onedrive_settings(
     request: Request,
+    _admin: AdminUser,
     refresh_token: Annotated[str, Form(...)],
     client_id: Annotated[Optional[str], Form()] = None,
     client_secret: Annotated[Optional[str], Form()] = None,
@@ -247,50 +235,19 @@ async def save_onedrive_settings(
         )
 
         # Best-effort .env file write
-        try:
-            env_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), ".env")
-            if not os.path.exists(env_path):
-                logger.warning(f".env file not found at {env_path}, skipping file write")
-            else:
-                logger.info(f"Updating OneDrive settings in {env_path}")
+        env_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), ".env")
+        onedrive_settings = {"ONEDRIVE_REFRESH_TOKEN": refresh_token}
+        if client_id:
+            onedrive_settings["ONEDRIVE_CLIENT_ID"] = client_id
+        if client_secret:
+            onedrive_settings["ONEDRIVE_CLIENT_SECRET"] = client_secret
+        if tenant_id:
+            onedrive_settings["ONEDRIVE_TENANT_ID"] = tenant_id
+        if folder_path:
+            onedrive_settings["ONEDRIVE_FOLDER_PATH"] = folder_path
 
-                with open(env_path, "r") as f:
-                    env_lines = f.readlines()
-
-                onedrive_settings = {"ONEDRIVE_REFRESH_TOKEN": refresh_token}
-                if client_id:
-                    onedrive_settings["ONEDRIVE_CLIENT_ID"] = client_id
-                if client_secret:
-                    onedrive_settings["ONEDRIVE_CLIENT_SECRET"] = client_secret
-                if tenant_id:
-                    onedrive_settings["ONEDRIVE_TENANT_ID"] = tenant_id
-                if folder_path:
-                    onedrive_settings["ONEDRIVE_FOLDER_PATH"] = folder_path
-
-                updated = set()
-                new_env_lines = []
-                for line in env_lines:
-                    stripped_line = line.rstrip()
-                    is_updated = False
-                    for key, value in onedrive_settings.items():
-                        if stripped_line.startswith(f"{key}=") or stripped_line.startswith(f"# {key}="):
-                            new_env_lines.append(f"{key}={value}")
-                            updated.add(key)
-                            is_updated = True
-                            break
-                    if not is_updated:
-                        new_env_lines.append(stripped_line)
-
-                for key, value in onedrive_settings.items():
-                    if key not in updated:
-                        new_env_lines.append(f"{key}={value}")
-
-                with open(env_path, "w") as f:
-                    f.write("\n".join(new_env_lines) + "\n")
-
-                logger.info("Successfully updated OneDrive settings in .env file")
-        except Exception as env_err:
-            logger.warning(f"Failed to write .env file (non-fatal): {env_err}")
+        if not update_env_file(env_path, onedrive_settings):
+            logger.info("Continuing with in-memory update despite .env file update failure or skip")
 
         # Update the settings in memory
         if refresh_token:

app/api/plans.py

@@ -196,11 +196,20 @@ def seed_plans(db: DbSession, _admin: AdminUser) -> dict[str, Any]:
 def reorder_plans(body: ReorderBody, db: DbSession, _admin: AdminUser) -> dict[str, Any]:
     """Update sort_order for each plan_id in *body.order* (position = index in list)."""
     updated = 0
-    for sort_order, plan_id in enumerate(body.order):
-        plan = db.query(SubscriptionPlan).filter(SubscriptionPlan.plan_id == plan_id).first()
+
+    # Fetch all requested plans in a single query to avoid N+1
+    plan_ids = body.order
+    plans = db.query(SubscriptionPlan).filter(SubscriptionPlan.plan_id.in_(plan_ids)).all()
+
+    # Build a map for fast O(1) lookup
+    plan_map = {p.plan_id: p for p in plans}
+
+    for sort_order, plan_id in enumerate(plan_ids):
+        plan = plan_map.get(plan_id)
         if plan:
             plan.sort_order = sort_order
             updated += 1
+
     try:
         db.commit()
     except Exception:

app/api/profile.py

@@ -18,7 +18,7 @@ import logging
 from hashlib import md5
 from typing import Annotated
 
-from fastapi import APIRouter, Depends, File, HTTPException, Request, UploadFile, status
+from fastapi import APIRouter, Depends, File, HTTPException, Request, Response, UploadFile, status
 from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session
 
@@ -99,6 +99,8 @@ class ProfileResponse(BaseModel):
     contact_email: str | None
     preferred_language: str | None
     preferred_theme: str | None
+    default_document_language: str | None
+    """ISO 639-1 code for the user's preferred document translation target language."""
     avatar_url: str
     """Gravatar URL or ``data:`` URI for a custom uploaded avatar."""
     is_local_user: bool
@@ -112,6 +114,10 @@ class ProfileUpdateRequest(BaseModel):
     contact_email: str | None = Field(default=None, max_length=255, description="Contact / notification e-mail")
     preferred_language: str | None = Field(default=None, description="ISO 639-1 language code, e.g. 'en', 'de'")
     preferred_theme: str | None = Field(default=None, description="Colour scheme: 'light', 'dark', or 'system'")
+    default_document_language: str | None = Field(
+        default=None,
+        description="ISO 639-1 code for the default document translation target language, e.g. 'en', 'de'",
+    )
 
 
 class ChangePasswordRequest(BaseModel):
@@ -149,6 +155,7 @@ async def get_profile(request: Request, db: DbSession) -> ProfileResponse:
         contact_email=profile.contact_email,  # type: ignore[arg-type]
         preferred_language=profile.preferred_language,  # type: ignore[arg-type]
         preferred_theme=profile.preferred_theme,  # type: ignore[arg-type]
+        default_document_language=profile.default_document_language,  # type: ignore[arg-type]
         avatar_url=avatar_url,
         is_local_user=is_local,
     )
@@ -156,7 +163,9 @@ async def get_profile(request: Request, db: DbSession) -> ProfileResponse:
 
 @router.patch("", response_model=ProfileResponse)
 @require_login
-async def update_profile(body: ProfileUpdateRequest, request: Request, db: DbSession) -> ProfileResponse:
+async def update_profile(
+    body: ProfileUpdateRequest, request: Request, response: Response, db: DbSession
+) -> ProfileResponse:
     """Update the current user's editable profile settings."""
     user_id = _get_user_id(request)
     profile = _get_or_create_profile(db, user_id)
@@ -171,6 +180,24 @@ async def update_profile(body: ProfileUpdateRequest, request: Request, db: DbSes
             )
         profile.preferred_language = lang or None  # type: ignore[assignment]
 
+        # Keep session and cookie in sync so detect_language() picks up
+        # the new preference immediately (without a DB round-trip).
+        if hasattr(request, "session"):
+            if lang:
+                request.session["preferred_language"] = lang
+            else:
+                request.session.pop("preferred_language", None)
+        if lang:
+            response.set_cookie(
+                key="docuelevate_lang",
+                value=lang,
+                max_age=30 * 24 * 60 * 60,
+                httponly=False,
+                samesite="lax",
+            )
+        else:
+            response.delete_cookie(key="docuelevate_lang")
+
     # Validate theme
     if body.preferred_theme is not None:
         theme = body.preferred_theme.lower().strip()
@@ -181,6 +208,16 @@ async def update_profile(body: ProfileUpdateRequest, request: Request, db: DbSes
             )
         profile.preferred_theme = theme or None  # type: ignore[assignment]
 
+    # Validate default document language
+    if body.default_document_language is not None:
+        doc_lang = body.default_document_language.lower().strip()
+        if doc_lang and doc_lang not in SUPPORTED_LANGUAGE_CODES:
+            raise HTTPException(
+                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                detail=f"Unsupported language code: {doc_lang}",
+            )
+        profile.default_document_language = doc_lang or None  # type: ignore[assignment]
+
     if body.display_name is not None:
         profile.display_name = body.display_name.strip() or None  # type: ignore[assignment]
 
@@ -205,6 +242,7 @@ async def update_profile(body: ProfileUpdateRequest, request: Request, db: DbSes
         contact_email=profile.contact_email,  # type: ignore[arg-type]
         preferred_language=profile.preferred_language,  # type: ignore[arg-type]
         preferred_theme=profile.preferred_theme,  # type: ignore[arg-type]
+        default_document_language=profile.default_document_language,  # type: ignore[arg-type]
         avatar_url=avatar_url,
         is_local_user=is_local,
     )

app/api/qr_auth.py

@@ -0,0 +1,233 @@
+"""QR code login API endpoints for mobile app authentication.
+
+Provides a secure challenge-response flow for logging into the mobile app
+by scanning a QR code displayed in the web interface:
+
+1. **Web user** calls ``POST /qr-auth/challenge`` → receives a time-limited
+   challenge token (encoded in the QR code).
+2. **Web UI** polls ``GET /qr-auth/challenge/{id}/status`` to detect when
+   the mobile app has claimed the challenge.
+3. **Mobile app** scans the QR code and calls ``POST /qr-auth/claim`` with
+   the challenge token + device name → receives an API token.
+
+Security properties:
+* Challenges expire after a configurable TTL (default 2 minutes).
+* Single-use: once claimed, a challenge cannot be reused (replay-safe).
+* Cryptographically random 64-byte tokens.
+* IP addresses are logged for audit.
+"""
+
+from __future__ import annotations
+
+import base64
+import io
+import logging
+from datetime import datetime
+from typing import Annotated, Any
+
+import segno
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from pydantic import BaseModel, Field
+from sqlalchemy.orm import Session
+
+from app.auth import require_login
+from app.database import get_db
+from app.middleware.audit_log import get_client_ip
+from app.utils.session_manager import (
+    claim_qr_challenge,
+    create_qr_challenge,
+    get_challenge_status,
+)
+from app.utils.user_scope import get_current_owner_id
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/qr-auth", tags=["qr-auth"])
+
+DbSession = Annotated[Session, Depends(get_db)]
+
+
+# ---------------------------------------------------------------------------
+# Auth helper
+# ---------------------------------------------------------------------------
+
+
+def _get_owner_id(request: Request) -> str:
+    """Return the current user's owner ID, raising 401 if unauthenticated."""
+    owner_id = get_current_owner_id(request)
+    if not owner_id:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated")
+    return owner_id
+
+
+CurrentOwner = Annotated[str, Depends(_get_owner_id)]
+
+
+# ---------------------------------------------------------------------------
+# Request / Response schemas
+# ---------------------------------------------------------------------------
+
+
+class CreateChallengeResponse(BaseModel):
+    """Response after creating a QR login challenge."""
+
+    challenge_id: int
+    challenge_token: str
+    expires_at: datetime
+    ttl_seconds: int = Field(description="Seconds until the challenge expires (use for client-side countdown).")
+    qr_payload: str = Field(description="The string to encode in the QR code.")
+    qr_code_svg: str = Field(description="Base64-encoded SVG data URI of the QR code, ready for use in an <img> src.")
+
+
+class ChallengeStatusResponse(BaseModel):
+    """Response for polling the status of a QR challenge."""
+
+    id: int
+    status: str  # "pending", "claimed", "expired", "cancelled"
+    device_name: str | None = None
+    claimed_at: datetime | None = None
+    expires_at: datetime
+
+
+class ClaimChallengeRequest(BaseModel):
+    """Request body for claiming a QR login challenge."""
+
+    challenge_token: str = Field(min_length=1, max_length=256)
+    device_name: str = Field(
+        default="Mobile App",
+        min_length=1,
+        max_length=120,
+        description="Human-readable device name.",
+    )
+
+
+class ClaimChallengeResponse(BaseModel):
+    """Response after successfully claiming a QR challenge."""
+
+    token: str
+    token_id: int
+    name: str
+    owner_id: str
+    created_at: datetime
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+# QR code rendering parameters
+_QR_ERROR_LEVEL = "M"  # Medium error correction (~15% recovery); sufficient for on-screen display
+_QR_SCALE = 4  # Each QR module is rendered as 4×4 SVG pixels
+
+
+def _generate_qr_svg(payload: str) -> str:
+    """Generate a QR code for *payload* and return it as a base64 SVG data URI.
+
+    Using ``segno`` (pure-Python, no Pillow dependency) and SVG output so the
+    QR code scales crisply at any resolution without requiring a canvas or any
+    client-side JavaScript library.
+    """
+    qr = segno.make(payload, error=_QR_ERROR_LEVEL)
+    buf = io.BytesIO()
+    qr.save(buf, kind="svg", scale=_QR_SCALE, xmldecl=False, svgclass=None, lineclass=None, omitsize=True)
+    svg_bytes = buf.getvalue()
+    return "data:image/svg+xml;base64," + base64.b64encode(svg_bytes).decode("ascii")
+
+
+# ---------------------------------------------------------------------------
+# Endpoints
+# ---------------------------------------------------------------------------
+
+
+@router.post("/challenge", status_code=status.HTTP_201_CREATED, response_model=CreateChallengeResponse)
+@require_login
+async def create_challenge(
+    request: Request,
+    owner_id: CurrentOwner,
+    db: DbSession,
+) -> dict[str, Any]:
+    """Create a new QR login challenge.
+
+    The returned ``qr_payload`` should be encoded into a QR code and
+    displayed to the user.  The mobile app scans this QR code and
+    calls the ``/claim`` endpoint.
+    """
+    ip = get_client_ip(request)
+    challenge = create_qr_challenge(db, owner_id, ip_address=ip)
+
+    # The QR payload is a JSON-like string with enough info for the mobile
+    # app to know the server URL and challenge token.
+    base_url = str(request.base_url).rstrip("/")
+    qr_payload = f"docuelevate://qr-login?token={challenge.challenge_token}&server={base_url}"
+
+    # Compute the TTL in seconds so the client can run a countdown timer
+    # without comparing absolute timestamps (which breaks when client and
+    # server clocks are out of sync).
+    ttl_seconds = max(0, int((challenge.expires_at - challenge.created_at).total_seconds()))
+
+    return {
+        "challenge_id": challenge.id,
+        "challenge_token": challenge.challenge_token,
+        "expires_at": challenge.expires_at,
+        "ttl_seconds": ttl_seconds,
+        "qr_payload": qr_payload,
+        "qr_code_svg": _generate_qr_svg(qr_payload),
+    }
+
+
+@router.get("/challenge/{challenge_id}/status", response_model=ChallengeStatusResponse)
+@require_login
+async def poll_challenge_status(
+    request: Request,
+    challenge_id: int,
+    owner_id: CurrentOwner,
+    db: DbSession,
+) -> dict[str, Any]:
+    """Poll the status of a QR login challenge.
+
+    The web UI calls this endpoint every few seconds to check if the
+    mobile app has scanned the QR code and claimed the challenge.
+    """
+    result = get_challenge_status(db, challenge_id, owner_id)
+    if not result:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Challenge not found")
+    return result
+
+
+@router.post("/claim", response_model=ClaimChallengeResponse)
+async def claim_challenge(
+    request: Request,
+    body: ClaimChallengeRequest,
+    db: DbSession,
+) -> dict[str, Any]:
+    """Claim a QR login challenge and receive an API token.
+
+    This endpoint is called by the mobile app after scanning a QR code.
+    It does **not** require authentication — the challenge token itself
+    serves as proof that the user authorized this login from their web
+    session.
+    """
+    ip = get_client_ip(request)
+    result = claim_qr_challenge(db, body.challenge_token, device_name=body.device_name, ip_address=ip)
+
+    if not result:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid, expired, or already claimed challenge.",
+        )
+
+    try:
+        from app.utils.audit_service import record_event
+
+        record_event(
+            db,
+            action="qr_login_claimed",
+            user=result["owner_id"],
+            resource_type="session",
+            ip_address=ip,
+            details={"device_name": body.device_name, "token_id": result["token_id"]},
+            severity="info",
+        )
+    except Exception:
+        logger.debug("Failed to write QR login audit event", exc_info=True)
+
+    return result

app/api/sessions.py

@@ -0,0 +1,196 @@
+"""API endpoints for managing user sessions.
+
+Provides endpoints for listing active sessions, revoking individual sessions,
+and the "log off everywhere" feature that invalidates all sessions and API
+tokens across all devices.
+"""
+
+from __future__ import annotations
+
+import logging
+from datetime import datetime
+from typing import Annotated, Any
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from pydantic import BaseModel
+from sqlalchemy.orm import Session
+
+from app.auth import require_login
+from app.database import get_db
+from app.middleware.audit_log import get_client_ip
+from app.utils.session_manager import (
+    get_session_lifetime_days,
+    list_user_sessions,
+    revoke_all_sessions,
+    revoke_session,
+)
+from app.utils.user_scope import get_current_owner_id
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/sessions", tags=["sessions"])
+
+DbSession = Annotated[Session, Depends(get_db)]
+
+
+# ---------------------------------------------------------------------------
+# Auth helper
+# ---------------------------------------------------------------------------
+
+
+def _get_owner_id(request: Request) -> str:
+    """Return the current user's owner ID, raising 401 if unauthenticated."""
+    owner_id = get_current_owner_id(request)
+    if not owner_id:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated")
+    return owner_id
+
+
+CurrentOwner = Annotated[str, Depends(_get_owner_id)]
+
+
+# ---------------------------------------------------------------------------
+# Response schemas
+# ---------------------------------------------------------------------------
+
+
+class SessionResponse(BaseModel):
+    """Serialised user session for the management UI."""
+
+    id: int
+    device_info: str | None
+    ip_address: str | None
+    created_at: datetime
+    last_active_at: datetime
+    expires_at: datetime
+    is_current: bool = False
+
+
+class SessionListResponse(BaseModel):
+    """Response for listing active sessions."""
+
+    sessions: list[SessionResponse]
+    session_lifetime_days: int
+
+
+class RevokeAllResponse(BaseModel):
+    """Response after revoking all sessions."""
+
+    revoked_count: int
+    message: str
+
+
+# ---------------------------------------------------------------------------
+# Endpoints
+# ---------------------------------------------------------------------------
+
+
+@router.get("/", response_model=SessionListResponse)
+@require_login
+async def list_sessions(
+    request: Request,
+    owner_id: CurrentOwner,
+    db: DbSession,
+) -> dict[str, Any]:
+    """List all active sessions for the current user."""
+    sessions = list_user_sessions(db, owner_id)
+
+    # Determine which session is the current one
+    current_token = request.session.get("_session_token")
+
+    session_list = []
+    for s in sessions:
+        session_list.append(
+            {
+                "id": s.id,
+                "device_info": s.device_info,
+                "ip_address": s.ip_address,
+                "created_at": s.created_at,
+                "last_active_at": s.last_active_at,
+                "expires_at": s.expires_at,
+                "is_current": s.session_token == current_token if current_token else False,
+            }
+        )
+
+    return {
+        "sessions": session_list,
+        "session_lifetime_days": get_session_lifetime_days(),
+    }
+
+
+@router.delete("/{session_id}", status_code=status.HTTP_204_NO_CONTENT)
+@require_login
+async def revoke_single_session(
+    request: Request,
+    session_id: int,
+    owner_id: CurrentOwner,
+    db: DbSession,
+) -> None:
+    """Revoke a specific session by ID."""
+    success = revoke_session(db, session_id, owner_id)
+    if not success:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Session not found")
+
+    try:
+        from app.utils.audit_service import record_event
+
+        record_event(
+            db,
+            action="session_revoked",
+            user=owner_id,
+            resource_type="session",
+            resource_id=str(session_id),
+            ip_address=get_client_ip(request),
+            severity="info",
+        )
+    except Exception:
+        logger.debug("Failed to write session revocation audit event", exc_info=True)
+
+
+@router.post("/revoke-all", response_model=RevokeAllResponse)
+@require_login
+async def revoke_all(
+    request: Request,
+    owner_id: CurrentOwner,
+    db: DbSession,
+) -> dict[str, Any]:
+    """Revoke all sessions except the current one ("log off everywhere").
+
+    Also revokes all active API tokens for the user, which invalidates
+    mobile app sessions and any programmatic access.
+    """
+    # Find current session to preserve it
+    current_token = request.session.get("_session_token")
+    current_session_id = None
+    if current_token:
+        from app.models import UserSession
+
+        current = db.query(UserSession).filter(UserSession.session_token == current_token).first()
+        if current:
+            current_session_id = current.id
+
+    count = revoke_all_sessions(
+        db,
+        owner_id,
+        except_session_id=current_session_id,
+        revoke_api_tokens=True,
+    )
+
+    try:
+        from app.utils.audit_service import record_event
+
+        record_event(
+            db,
+            action="revoke_all_sessions",
+            user=owner_id,
+            resource_type="session",
+            ip_address=get_client_ip(request),
+            details={"revoked_count": count},
+            severity="warning",
+        )
+    except Exception:
+        logger.debug("Failed to write revoke-all audit event", exc_info=True)
+
+    return {
+        "revoked_count": count,
+        "message": f"Successfully revoked {count} session(s) and all API tokens.",
+    }

app/api/shared_links.py

@@ -313,16 +313,18 @@ async def list_shared_links(
     active_only: bool = Query(False, description="When true, only return active (non-revoked) links"),
 ) -> list[dict[str, Any]]:
     """List all shared links created by the authenticated user."""
-    q = db.query(SharedLink).filter(SharedLink.owner_id == owner_id)
+    q = (
+        db.query(SharedLink, FileRecord.original_filename)
+        .outerjoin(FileRecord, SharedLink.file_id == FileRecord.id)
+        .filter(SharedLink.owner_id == owner_id)
+    )
     if active_only:
         q = q.filter(SharedLink.is_active.is_(True))
-    links = q.order_by(SharedLink.created_at.desc()).all()
+    links_with_filenames = q.order_by(SharedLink.created_at.desc()).all()
 
     base_url = str(request.base_url).rstrip("/")
     result = []
-    for link in links:
-        file_record = db.query(FileRecord).filter(FileRecord.id == link.file_id).first()
-        filename = file_record.original_filename if file_record else None
+    for link, filename in links_with_filenames:
         result.append(_link_to_dict(link, base_url, filename))
     return result
 

app/api/system_reset.py

@@ -0,0 +1,124 @@
+"""
+System reset API endpoints for DocuElevate.
+
+Provides admin-only REST endpoints for:
+- Full system reset (wipe all user data)
+- Reset with re-import (move originals → reimport folder, wipe, re-ingest)
+
+Both operations require the ``ENABLE_FACTORY_RESET=True`` feature flag and
+admin privileges.
+"""
+
+import logging
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from pydantic import BaseModel
+from sqlalchemy.orm import Session
+
+from app.config import settings
+from app.database import get_db
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/admin/system-reset", tags=["system-reset"])
+
+
+def _require_admin(request: Request) -> dict:
+    """Ensure the caller is an admin.  Raises 403 otherwise."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
+def _require_feature_enabled() -> None:
+    """Raise 404 when the factory-reset feature flag is off."""
+    if not settings.enable_factory_reset:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="System reset is not enabled. Set ENABLE_FACTORY_RESET=True to activate.",
+        )
+
+
+class ResetRequest(BaseModel):
+    """Body for system reset endpoints.  Requires explicit confirmation."""
+
+    confirmation: str
+
+
+@router.post("/full")
+async def full_reset(
+    body: ResetRequest,
+    _admin: AdminUser,
+    db: Session = Depends(get_db),
+) -> dict:
+    """Wipe all user data (database + work-files).
+
+    The caller must send ``{"confirmation": "DELETE"}`` to proceed.
+    """
+    _require_feature_enabled()
+
+    if body.confirmation != "DELETE":
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Confirmation required: send {"confirmation": "DELETE"} to proceed.',
+        )
+
+    from app.utils.system_reset import perform_full_reset
+
+    try:
+        result = perform_full_reset(db)
+    except Exception as exc:
+        logger.exception("Full system reset failed")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"System reset failed: {exc}",
+        ) from exc
+
+    return {"status": "ok", "result": result}
+
+
+@router.post("/reimport")
+async def reset_and_reimport(
+    body: ResetRequest,
+    _admin: AdminUser,
+    db: Session = Depends(get_db),
+) -> dict:
+    """Move original files to a reimport folder, wipe everything, and
+    configure the reimport folder as a watch folder for automatic
+    re-ingestion.
+
+    The caller must send ``{"confirmation": "REIMPORT"}`` to proceed.
+    """
+    _require_feature_enabled()
+
+    if body.confirmation != "REIMPORT":
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail='Confirmation required: send {"confirmation": "REIMPORT"} to proceed.',
+        )
+
+    from app.utils.system_reset import perform_reset_and_reimport
+
+    try:
+        result = perform_reset_and_reimport(db)
+    except Exception as exc:
+        logger.exception("Reset-and-reimport failed")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Reset and reimport failed: {exc}",
+        ) from exc
+
+    return {"status": "ok", "result": result}
+
+
+@router.get("/status")
+async def reset_status(_admin: AdminUser) -> dict:
+    """Return whether the system reset feature is enabled."""
+    return {
+        "enabled": settings.enable_factory_reset,
+        "factory_reset_on_startup": settings.factory_reset_on_startup,
+    }

app/api/translation.py

@@ -0,0 +1,156 @@
+"""
+API endpoints for document translation.
+
+Provides on-the-fly translation via the AI provider and access to the
+persisted default-language translation.
+"""
+
+import logging
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
+from fastapi.responses import JSONResponse
+from sqlalchemy.orm import Session
+
+from app.auth import require_login
+from app.config import settings
+from app.database import get_db
+from app.models import FileRecord
+from app.utils.ai_provider import get_ai_provider
+from app.utils.user_scope import apply_owner_filter
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+DbSession = Annotated[Session, Depends(get_db)]
+
+# Maximum characters sent to the AI provider for a single translation request.
+_MAX_TRANSLATION_INPUT = 50_000
+
+
+def _get_file_or_404(db: Session, file_id: int, request: Request) -> FileRecord:
+    """Fetch a FileRecord visible to the current user or raise 404."""
+    query = db.query(FileRecord).filter(FileRecord.id == file_id)
+    query = apply_owner_filter(query, request)
+    record = query.first()
+    if not record:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="File not found")
+    return record
+
+
+@router.get("/files/{file_id}/translation/default")
+@require_login
+def get_default_translation(
+    request: Request,
+    file_id: int,
+    db: DbSession,
+) -> JSONResponse:
+    """Return the persisted default-language translation for a document.
+
+    Returns 404 if no default-language translation has been generated yet
+    (e.g. because the document is already in the default language).
+    """
+    record = _get_file_or_404(db, file_id, request)
+
+    if not record.default_language_text:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="No default-language translation available for this file",
+        )
+
+    return JSONResponse(
+        content={
+            "file_id": record.id,
+            "detected_language": record.detected_language,
+            "default_language_code": record.default_language_code,
+            "text": record.default_language_text,
+        }
+    )
+
+
+@router.get("/files/{file_id}/translate")
+@require_login
+def translate_on_the_fly(
+    request: Request,
+    file_id: int,
+    db: DbSession,
+    lang: str = Query(..., min_length=2, max_length=10, description="Target language ISO 639-1 code"),
+) -> JSONResponse:
+    """Translate a document's extracted text into an arbitrary language on the fly.
+
+    The translation is generated via the configured AI provider and is **not**
+    persisted.  For the default-language translation, use the
+    ``/files/{file_id}/translation/default`` endpoint instead.
+    """
+    record = _get_file_or_404(db, file_id, request)
+
+    source_text = record.ocr_text
+    if not source_text:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="No extracted text available for this file — translation requires OCR text",
+        )
+
+    # If the requested language matches what is already stored, return it directly.
+    if record.default_language_code and lang == record.default_language_code and record.default_language_text:
+        return JSONResponse(
+            content={
+                "file_id": record.id,
+                "source_language": record.detected_language,
+                "target_language": lang,
+                "text": record.default_language_text,
+                "cached": True,
+            }
+        )
+
+    # If the detected language already matches, return the original text.
+    detected = record.detected_language
+    if detected and detected == lang:
+        return JSONResponse(
+            content={
+                "file_id": record.id,
+                "source_language": detected,
+                "target_language": lang,
+                "text": source_text,
+                "cached": True,
+            }
+        )
+
+    # Truncate to keep AI costs bounded.
+    text_to_translate = source_text[:_MAX_TRANSLATION_INPUT]
+
+    try:
+        provider = get_ai_provider()
+        model = settings.ai_model or settings.openai_model
+        translated = provider.chat_completion(
+            messages=[
+                {
+                    "role": "system",
+                    "content": (
+                        f"You are a professional translator. Translate the following text "
+                        f"into {lang}. Preserve the original formatting, paragraph structure, "
+                        f"and meaning. Do not add any commentary — output ONLY the translated text."
+                    ),
+                },
+                {"role": "user", "content": text_to_translate},
+            ],
+            model=model,
+            temperature=0.3,
+        )
+    except Exception as exc:
+        logger.exception(f"On-the-fly translation failed for file {file_id}: {exc}")
+        raise HTTPException(
+            status_code=status.HTTP_502_BAD_GATEWAY,
+            detail="Translation failed — the AI provider returned an error",
+        )
+
+    return JSONResponse(
+        content={
+            "file_id": record.id,
+            "source_language": detected or "unknown",
+            "target_language": lang,
+            "text": translated,
+            "cached": False,
+        }
+    )

app/api/url_upload.py

@@ -2,7 +2,6 @@
 API endpoint for processing files from URLs
 """
 
-import ipaddress
 import logging
 import mimetypes
 import os
@@ -10,7 +9,8 @@ import urllib.parse
 import uuid
 from typing import Optional
 
-import requests
+import aiofiles
+import httpx
 from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel, HttpUrl, field_validator
 
@@ -19,6 +19,7 @@ from app.config import settings
 from app.tasks.process_document import process_document
 from app.utils.allowed_types import ALLOWED_MIME_TYPES
 from app.utils.filename_utils import sanitize_filename
+from app.utils.network import is_private_ip
 
 # Set up logging
 logger = logging.getLogger(__name__)
@@ -42,37 +43,6 @@ class URLUploadRequest(BaseModel):
         return v
 
 
-def is_private_ip(hostname: str) -> bool:
-    """
-    Check if a hostname resolves to a private/internal IP address.
-    Protects against SSRF attacks by blocking access to internal networks.
-    """
-    try:
-        # Try to parse as IP address directly
-        ip = ipaddress.ip_address(hostname)
-        return ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved
-    except ValueError:
-        # Not a direct IP, try to resolve hostname
-        try:
-            import socket
-
-            # Get all IP addresses for this hostname
-            addr_info = socket.getaddrinfo(hostname, None)
-            for info in addr_info:
-                ip_str = info[4][0]
-                ip = ipaddress.ip_address(ip_str)
-                # Block if ANY resolved IP is private/internal
-                if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
-                    return True
-            return False
-        except (socket.gaierror, socket.error):
-            # Cannot resolve - allow for testing/development
-            # In production, DNS should work properly
-            # Log this for debugging
-            logger.warning(f"Could not resolve hostname: {hostname}")
-            return False  # Changed from True to False to allow external domains in tests
-
-
 def validate_url_safety(url: str) -> None:
     """
     Validate that URL is safe to fetch (SSRF protection).
@@ -184,67 +154,73 @@ async def process_url(request: Request, url_request: URLUploadRequest):
         logger.info(f"Downloading file from URL: {url}")
 
         # Use configured timeout to prevent hanging
-        response = requests.get(
-            url,
+        async with httpx.AsyncClient(
             timeout=settings.http_request_timeout,
-            stream=True,  # Stream to handle large files
-            allow_redirects=True,  # Follow redirects
+            follow_redirects=True,
             headers={
                 "User-Agent": "DocuElevate/1.0",  # Identify ourselves
             },
-        )
-        response.raise_for_status()
+        ) as client:
+            async with client.stream("GET", url) as response:
+                response.raise_for_status()
 
-        # Validate content type
-        content_type = response.headers.get("Content-Type", "")
-        if not validate_file_type(content_type, safe_filename):
-            raise HTTPException(
-                status_code=400,
-                detail=f"Unsupported file type: {content_type}. "
-                "Supported types: PDF, Office documents, images, plain text",
-            )
+                # Validate content type
+                content_type = response.headers.get("Content-Type", "")
+                if not validate_file_type(content_type, safe_filename):
+                    raise HTTPException(
+                        status_code=400,
+                        detail=f"Unsupported file type: {content_type}. "
+                        "Supported types: PDF, Office documents, images, plain text",
+                    )
 
-        # Check content length before downloading
-        content_length = response.headers.get("Content-Length")
-        if content_length:
-            file_size = int(content_length)
-            max_size = settings.max_upload_size
-            if file_size > max_size:
-                raise HTTPException(
-                    status_code=413,
-                    detail=f"File too large: {file_size} bytes (max {max_size} bytes)",
-                )
-
-        # Generate unique filename
-        unique_id = str(uuid.uuid4())
-        if "." in safe_filename:
-            file_extension = safe_filename.rsplit(".", 1)[1]
-            target_filename = f"{unique_id}.{file_extension}"
-        else:
-            target_filename = unique_id
-
-        target_path = os.path.join(settings.workdir, target_filename)
-
-        # Download file in chunks to handle large files
-        downloaded_size = 0
-        max_size = settings.max_upload_size
-
-        with open(target_path, "wb") as f:
-            for chunk in response.iter_content(chunk_size=8192):
-                if chunk:
-                    f.write(chunk)
-                    downloaded_size += len(chunk)
-
-                    # Check size during download
-                    if downloaded_size > max_size:
-                        # Remove partial file
-                        f.close()
-                        os.remove(target_path)
+                # Check content length before downloading
+                content_length = response.headers.get("Content-Length")
+                if content_length:
+                    file_size = int(content_length)
+                    max_size = settings.max_upload_size
+                    if file_size > max_size:
                         raise HTTPException(
                             status_code=413,
-                            detail=f"File too large: exceeded {max_size} bytes during download",
+                            detail=f"File too large: {file_size} bytes (max {max_size} bytes)",
                         )
 
+                # Generate unique filename
+                unique_id = str(uuid.uuid4())
+
+                # Check for extension using original_filename to avoid any CodeQL issues
+                # with safe_filename which is derived from the URL directly.
+                if "." in original_filename:
+                    _, ext = os.path.splitext(original_filename)
+                    # Strip out the leading dot and any non-alphanumeric chars
+                    clean_ext = "".join(c for c in ext if c.isalnum())
+                    if not clean_ext:
+                        clean_ext = "bin"
+                    target_filename = f"{unique_id}.{clean_ext}"
+                else:
+                    target_filename = unique_id
+
+                target_path = os.path.join(settings.workdir, target_filename)
+
+                # Download file in chunks to handle large files
+                downloaded_size = 0
+                max_size = settings.max_upload_size
+
+                async with aiofiles.open(target_path, "wb") as f:
+                    async for chunk in response.aiter_bytes(chunk_size=8192):
+                        if chunk:
+                            await f.write(chunk)
+                            downloaded_size += len(chunk)
+
+                            # Check size during download
+                            if downloaded_size > max_size:
+                                # Remove partial file
+                                await f.close()
+                                os.remove(target_path)
+                                raise HTTPException(
+                                    status_code=413,
+                                    detail=f"File too large: exceeded {max_size} bytes during download",
+                                )
+
         logger.info(f"Downloaded file from URL '{url}' as '{target_filename}' ({downloaded_size} bytes)")
 
         # Enqueue for processing
@@ -258,19 +234,19 @@ async def process_url(request: Request, url_request: URLUploadRequest):
             "size": downloaded_size,
         }
 
-    except requests.exceptions.Timeout:
+    except httpx.TimeoutException:
         logger.error(f"Timeout while downloading file from URL: {url}")
         raise HTTPException(status_code=408, detail="Request timeout: server took too long to respond")
 
-    except requests.exceptions.ConnectionError as e:
+    except httpx.ConnectError as e:
         logger.error(f"Connection error while downloading file from URL: {url} - {str(e)}")
         raise HTTPException(status_code=502, detail=f"Failed to connect to URL: {str(e)}")
 
-    except requests.exceptions.HTTPError as e:
+    except httpx.HTTPStatusError as e:
         logger.error(f"HTTP error while downloading file from URL: {url} - {str(e)}")
         raise HTTPException(status_code=e.response.status_code, detail=f"HTTP error: {str(e)}")
 
-    except requests.exceptions.RequestException as e:
+    except httpx.RequestError as e:
         logger.error(f"Error downloading file from URL: {url} - {str(e)}")
         raise HTTPException(status_code=500, detail=f"Failed to download file: {str(e)}")
 

app/auth.py

@@ -4,12 +4,13 @@ import logging
 import pathlib
 from datetime import datetime, timezone
 from functools import wraps
-from urllib.parse import urlparse
+from urllib.parse import urlencode, urlparse
 
 from authlib.integrations.starlette_client import OAuth
 from fastapi import APIRouter, Depends, Request, status
 from fastapi.responses import JSONResponse
 from fastapi.templating import Jinja2Templates
+from sqlalchemy import func
 from sqlalchemy.orm import Session
 from starlette.responses import RedirectResponse
 
@@ -124,8 +125,36 @@ def get_current_user(request: Request):
     # Check for Bearer token auth first (API tokens)
     api_user = getattr(request.state, "api_token_user", None)
     if isinstance(api_user, dict):
+        logger.debug("[AUTH] get_current_user: resolved from API token (user_id=%s)", api_user.get("id"))
         return api_user
-    return request.session.get("user")
+    session_user = request.session.get("user")
+    if session_user:
+        # Validate server-side session if a session token is present
+        session_token = request.session.get("_session_token")
+        if session_token:
+            try:
+                from app.database import SessionLocal
+                from app.utils.session_manager import validate_session
+
+                db = SessionLocal()
+                try:
+                    valid = validate_session(db, session_token)
+                    if not valid:
+                        logger.debug("[AUTH] get_current_user: server-side session invalid — clearing")
+                        request.session.pop("user", None)
+                        request.session.pop("_session_token", None)
+                        return None
+                finally:
+                    db.close()
+            except Exception:
+                logger.debug("[AUTH] get_current_user: session validation error", exc_info=True)
+        logger.debug(
+            "[AUTH] get_current_user: resolved from session (user=%s)",
+            session_user.get("preferred_username") or session_user.get("email") or session_user.get("id"),
+        )
+    else:
+        logger.debug("[AUTH] get_current_user: no user in session or API token")
+    return session_user
 
 
 def _resolve_bearer_user(request: Request, db: Session) -> dict | None:
@@ -140,10 +169,12 @@ def _resolve_bearer_user(request: Request, db: Session) -> dict | None:
     """
     auth_header = request.headers.get("authorization", "")
     if not isinstance(auth_header, str) or not auth_header.startswith("Bearer "):
+        logger.debug("[AUTH] _resolve_bearer_user: no Bearer token in Authorization header")
         return None
 
     raw_token = auth_header[7:]
     if not raw_token or not isinstance(raw_token, str):
+        logger.debug("[AUTH] _resolve_bearer_user: empty or invalid token after 'Bearer ' prefix")
         return None
 
     from app.api.api_tokens import hash_token
@@ -152,8 +183,15 @@ def _resolve_bearer_user(request: Request, db: Session) -> dict | None:
     token_hash = hash_token(raw_token)
     db_token = db.query(ApiToken).filter(ApiToken.token_hash == token_hash, ApiToken.is_active.is_(True)).first()
     if db_token is None:
+        logger.debug("[AUTH] _resolve_bearer_user: no active API token matched the provided hash")
         return None
 
+    logger.debug(
+        "[AUTH] _resolve_bearer_user: matched API token id=%s owner=%s",
+        db_token.id,
+        db_token.owner_id,
+    )
+
     # Update usage tracking
     try:
         db_token.last_used_at = datetime.now(timezone.utc)
@@ -204,16 +242,18 @@ def require_login(func):
 
     @wraps(func)
     async def wrapper(request: Request, *args, **kwargs):
+        url_path = urlparse(str(request.url)).path
         # Check session auth first
         if request.session.get("user"):
+            logger.debug("[AUTH] require_login: session auth OK for %s", url_path)
             if inspect.iscoroutinefunction(func):
                 return await func(*args, request=request, **kwargs)
             else:
                 return func(*args, request=request, **kwargs)
 
         # Fall back to Bearer token auth for API endpoints
-        url_path = urlparse(str(request.url)).path
         if url_path.startswith("/api/"):
+            logger.debug("[AUTH] require_login: no session, trying Bearer token for %s", url_path)
             try:
                 from app.database import SessionLocal
 
@@ -227,17 +267,22 @@ def require_login(func):
 
             if api_user:
                 request.state.api_token_user = api_user
+                logger.debug(
+                    "[AUTH] require_login: Bearer token auth OK for %s (user=%s)", url_path, api_user.get("id")
+                )
                 if inspect.iscoroutinefunction(func):
                     return await func(*args, request=request, **kwargs)
                 else:
                     return func(*args, request=request, **kwargs)
 
+            logger.debug("[AUTH] require_login: no valid auth for API endpoint %s — returning 401", url_path)
             return JSONResponse(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 content={"error": "Not authenticated"},
             )
 
         # Non-API endpoint with no session — redirect to login
+        logger.debug("[AUTH] require_login: no session for %s — redirecting to /login", url_path)
         request.session["redirect_after_login"] = str(request.url)
         return RedirectResponse(url="/login", status_code=status.HTTP_302_FOUND)
 
@@ -254,6 +299,38 @@ def get_gravatar_url(email):
 
 async def login(request: Request):
     """Show login page with appropriate authentication options."""
+    # Persist the mobile deep-link redirect URI in the session so it survives
+    # the OAuth provider round-trip and is available when auth completes.
+    # Accepted schemes:
+    #   • "docuelevate://" — production / EAS builds (custom app scheme)
+    #   • "exp://"         — Expo Go development client
+    # Only custom (non-HTTP) schemes are accepted to prevent open-redirect abuse.
+    _MOBILE_ALLOWED_SCHEMES = ("docuelevate://", "exp://")
+    if request.query_params.get("mobile") == "1":
+        redirect_uri = request.query_params.get("redirect_uri", "")
+        logger.debug(
+            "[MOBILE] Login page opened with mobile=1: redirect_uri=%r client_ip=%s",
+            redirect_uri,
+            get_client_ip(request),
+        )
+        if any(redirect_uri.startswith(s) for s in _MOBILE_ALLOWED_SCHEMES):
+            request.session["mobile_redirect_uri"] = redirect_uri
+            logger.info(
+                "[MOBILE] Mobile redirect URI stored in session: %r",
+                redirect_uri,
+            )
+        else:
+            logger.warning(
+                "[MOBILE] Rejected redirect_uri with disallowed scheme: %r (allowed: %s)",
+                redirect_uri,
+                ", ".join(_MOBILE_ALLOWED_SCHEMES),
+            )
+    else:
+        logger.debug(
+            "[MOBILE] Login page opened without mobile=1 (standard browser flow) client_ip=%s",
+            get_client_ip(request),
+        )
+
     return templates.TemplateResponse(
         "login.html",
         {
@@ -274,9 +351,15 @@ async def login(request: Request):
 async def oauth_login(request: Request):
     """Handle OAuth login flow"""
     if not OAUTH_CONFIGURED:
+        logger.debug("[AUTH] oauth_login: OAuth not configured — redirecting to /login")
         return RedirectResponse(url="/login?error=OAuth+not+configured", status_code=status.HTTP_302_FOUND)
 
     redirect_uri = request.url_for("oauth_callback")
+    logger.debug(
+        "[AUTH] oauth_login: initiating Authentik OAuth redirect_uri=%s session_keys=%s",
+        redirect_uri,
+        list(request.session.keys()),
+    )
     return await oauth.authentik.authorize_redirect(request, redirect_uri)
 
 
@@ -291,13 +374,23 @@ async def social_login(request: Request, provider: str):
         A redirect to the provider's authorization page, or back to /login on error.
     """
     if provider not in SOCIAL_PROVIDERS:
+        logger.debug(
+            "[AUTH] social_login: unknown provider=%r (registered=%s)", provider, list(SOCIAL_PROVIDERS.keys())
+        )
         return RedirectResponse(url="/login?error=Unknown+social+provider", status_code=status.HTTP_302_FOUND)
 
     redirect_uri = request.url_for("social_callback", provider=provider)
     oauth_client = getattr(oauth, provider, None)
     if oauth_client is None:
+        logger.debug("[AUTH] social_login: provider=%r registered but OAuth client not configured", provider)
         return RedirectResponse(url="/login?error=Provider+not+configured", status_code=status.HTTP_302_FOUND)
 
+    logger.debug(
+        "[AUTH] social_login: initiating %s OAuth, redirect_uri=%s session_keys=%s",
+        provider,
+        redirect_uri,
+        list(request.session.keys()),
+    )
     return await oauth_client.authorize_redirect(request, redirect_uri)
 
 
@@ -356,27 +449,39 @@ async def social_callback(request: Request, provider: str, db: Session = Depends
         A redirect to the user's original destination or the upload page.
     """
     if provider not in SOCIAL_PROVIDERS:
+        logger.debug("[AUTH] social_callback: unknown provider=%r", provider)
         return RedirectResponse(url="/login?error=Unknown+social+provider", status_code=status.HTTP_302_FOUND)
 
     oauth_client = getattr(oauth, provider, None)
     if oauth_client is None:
+        logger.debug("[AUTH] social_callback: provider=%r not configured", provider)
         return RedirectResponse(url="/login?error=Provider+not+configured", status_code=status.HTTP_302_FOUND)
 
     try:
+        logger.debug("[AUTH] social_callback: exchanging auth code for provider=%s", provider)
         token = await oauth_client.authorize_access_token(request)
 
         # Try standard OIDC userinfo first, fall back to token-embedded userinfo
         raw_userinfo = token.get("userinfo")
         if not raw_userinfo:
+            logger.debug("[AUTH] social_callback: no userinfo in token, fetching from userinfo endpoint")
             try:
                 resp = await oauth_client.userinfo(token=token)
                 raw_userinfo = resp if isinstance(resp, dict) else resp.json() if hasattr(resp, "json") else {}
             except Exception:
+                logger.debug("[AUTH] social_callback: userinfo endpoint failed, using empty dict", exc_info=True)
                 raw_userinfo = {}
 
         user_data = _normalize_social_userinfo(provider, token, raw_userinfo)
+        logger.debug(
+            "[AUTH] social_callback: normalized user_data email=%s sub=%s provider=%s",
+            user_data.get("email"),
+            user_data.get("sub"),
+            provider,
+        )
 
         if not user_data.get("email"):
+            logger.debug("[AUTH] social_callback: no email in user_data — aborting")
             return RedirectResponse(
                 url="/login?error=Could+not+retrieve+email+from+provider",
                 status_code=status.HTTP_302_FOUND,
@@ -395,6 +500,27 @@ async def social_callback(request: Request, provider: str, db: Session = Depends
 
         request.session["user"] = user_data
 
+        # Create server-side session for tracking and revocation
+        try:
+            from app.utils.session_manager import create_session
+
+            _session_user_id = (
+                user_data.get("sub")
+                or user_data.get("preferred_username")
+                or user_data.get("email")
+                or user_data.get("id")
+            )
+            if _session_user_id:
+                user_session = create_session(
+                    db,
+                    user_id=_session_user_id,
+                    ip_address=get_client_ip(request),
+                    user_agent=request.headers.get("user-agent"),
+                )
+                request.session["_session_token"] = user_session.session_token
+        except Exception:
+            logger.debug("[AUTH] Failed to create server-side session for social user", exc_info=True)
+
         # Auto-create or update UserProfile
         _ensure_user_profile(db, user_data, is_admin=False)
 
@@ -407,17 +533,31 @@ async def social_callback(request: Request, provider: str, db: Session = Depends
         user_id = (
             user_data.get("sub") or user_data.get("preferred_username") or user_data.get("email") or user_data.get("id")
         )
+
+        # Mobile app flow: issue an inline API token and redirect back to the app.
+        logger.debug(
+            "[MOBILE] social_callback: checking for mobile redirect (session has mobile_redirect_uri=%s)",
+            "mobile_redirect_uri" in request.session,
+        )
+        mobile_resp = _create_mobile_redirect(request, db)
+        if mobile_resp:
+            logger.info("[MOBILE] social_callback: returning mobile redirect response for provider=%s", provider)
+            return mobile_resp
+
         if user_id:
             profile = db.query(_UserProfile).filter(_UserProfile.user_id == user_id).first()
             if profile and not profile.onboarding_completed:
+                logger.debug("[AUTH] social_callback: user=%s needs onboarding, redirecting", user_id)
                 post_onboarding = request.session.pop("redirect_after_login", "/upload")
                 request.session["post_onboarding_redirect"] = post_onboarding
                 return RedirectResponse(url="/onboarding", status_code=status.HTTP_302_FOUND)
 
         redirect_url = request.session.pop("redirect_after_login", "/upload")
+        logger.debug("[AUTH] social_callback: login complete, redirecting to %s", redirect_url)
         return RedirectResponse(url=redirect_url, status_code=status.HTTP_302_FOUND)
     except Exception as e:
         logger.warning("[SECURITY] SOCIAL_LOGIN_FAILURE provider=%s error=%s", provider, type(e).__name__)
+        logger.debug("[AUTH] social_callback: full exception for provider=%s", provider, exc_info=True)
         return RedirectResponse(
             url="/login?error=Social+login+failed.+Please+try+again.", status_code=status.HTTP_302_FOUND
         )
@@ -522,15 +662,23 @@ def _ensure_user_profile(db: Session, user_data: dict, is_admin: bool = False) -
 async def oauth_callback(request: Request, db: Session = Depends(get_db)):
     """Handle OAuth callback from provider"""
     try:
+        logger.debug("[AUTH] oauth_callback: exchanging authorization code for token")
         token = await oauth.authentik.authorize_access_token(request)
         userinfo = token.get("userinfo")
         if not userinfo:
+            logger.debug("[AUTH] oauth_callback: no userinfo in token response — aborting")
             return RedirectResponse(
                 url="/login?error=Failed+to+retrieve+user+information", status_code=status.HTTP_302_FOUND
             )
 
         # Store user info in session
         user_data = dict(userinfo)
+        logger.debug(
+            "[AUTH] oauth_callback: received userinfo email=%s sub=%s groups=%s",
+            user_data.get("email"),
+            user_data.get("sub"),
+            user_data.get("groups", []),
+        )
 
         # Add Gravatar picture if no picture is provided
         if not user_data.get("picture") and user_data.get("email"):
@@ -545,12 +693,39 @@ async def oauth_callback(request: Request, db: Session = Depends(get_db)):
             groups = user_data.get("groups", [])
             admin_group = (settings.admin_group_name or "admin").strip().lower()
             is_admin = admin_group in [group.lower() for group in groups]
+            logger.debug(
+                "[AUTH] oauth_callback: admin group check — looking for %r in %s → is_admin=%s",
+                admin_group,
+                [g.lower() for g in groups],
+                is_admin,
+            )
 
         # Set is_admin flag (defaults to False for OAuth users unless they're in admin group)
         user_data["is_admin"] = is_admin
 
         request.session["user"] = user_data
 
+        # Create server-side session for tracking and revocation
+        try:
+            from app.utils.session_manager import create_session
+
+            _session_user_id = (
+                user_data.get("sub")
+                or user_data.get("preferred_username")
+                or user_data.get("email")
+                or user_data.get("id")
+            )
+            if _session_user_id:
+                user_session = create_session(
+                    db,
+                    user_id=_session_user_id,
+                    ip_address=get_client_ip(request),
+                    user_agent=request.headers.get("user-agent"),
+                )
+                request.session["_session_token"] = user_session.session_token
+        except Exception:
+            logger.debug("[AUTH] Failed to create server-side session for OAuth user", exc_info=True)
+
         # Auto-create or update UserProfile so the user appears in admin user management
         _ensure_user_profile(db, user_data, is_admin=is_admin)
 
@@ -568,18 +743,34 @@ async def oauth_callback(request: Request, db: Session = Depends(get_db)):
         user_id = (
             user_data.get("sub") or user_data.get("preferred_username") or user_data.get("email") or user_data.get("id")
         )
+
+        # Mobile app flow: issue an inline API token and redirect back to the app.
+        # This check runs before onboarding so native-app users are never sent
+        # to the web-based onboarding wizard.
+        logger.debug(
+            "[MOBILE] oauth_callback: checking for mobile redirect (session has mobile_redirect_uri=%s)",
+            "mobile_redirect_uri" in request.session,
+        )
+        mobile_resp = _create_mobile_redirect(request, db)
+        if mobile_resp:
+            logger.info("[MOBILE] oauth_callback: returning mobile redirect response")
+            return mobile_resp
+
         if user_id:
             profile = db.query(_UserProfile).filter(_UserProfile.user_id == user_id).first()
             if profile and not profile.onboarding_completed:
+                logger.debug("[AUTH] oauth_callback: user=%s needs onboarding, redirecting", user_id)
                 post_onboarding = request.session.pop("redirect_after_login", "/upload")
                 request.session["post_onboarding_redirect"] = post_onboarding
                 return RedirectResponse(url="/onboarding", status_code=status.HTTP_302_FOUND)
 
         # Redirect to original destination or default
         redirect_url = request.session.pop("redirect_after_login", "/upload")
+        logger.debug("[AUTH] oauth_callback: login complete, redirecting to %s", redirect_url)
         return RedirectResponse(url=redirect_url, status_code=status.HTTP_302_FOUND)
     except Exception as e:
         logger.warning(f"[SECURITY] OAUTH_LOGIN_FAILURE error={type(e).__name__}")
+        logger.debug("[AUTH] oauth_callback: full exception details", exc_info=True)
         return RedirectResponse(url=f"/login?error=Authentication+failed:+{str(e)}", status_code=status.HTTP_302_FOUND)
 
 
@@ -625,6 +816,98 @@ def _record_login_event(
         logger.debug("Failed to write login audit event for user=%s", username, exc_info=True)
 
 
+def _create_mobile_redirect(request: Request, db: Session) -> RedirectResponse | None:
+    """Generate a mobile API token and return a redirect to the mobile app.
+
+    If ``mobile_redirect_uri`` is stored in the session (set when the login
+    page was opened with ``?mobile=1&redirect_uri=docuelevate://...``), this
+    function creates a long-lived API token, appends it as a ``?token=``
+    query parameter to the redirect URI, and returns the redirect so that
+    ``WebBrowser.openAuthSessionAsync`` in the Expo app intercepts the
+    deep link and stores the token.
+
+    Returns ``None`` when the request is not part of a mobile SSO flow.
+
+    Args:
+        request: The current FastAPI request.  The ``user`` dict must already
+            be stored in ``request.session`` before calling this function.
+        db: Active database session used to persist the new API token.
+
+    Returns:
+        A ``RedirectResponse`` to the deep-link URI with ``?token=<plaintext>``,
+        or ``None`` if no mobile redirect URI is pending.
+    """
+    mobile_redirect_uri = request.session.pop("mobile_redirect_uri", None)
+    if not mobile_redirect_uri:
+        logger.debug("[MOBILE] _create_mobile_redirect: no mobile_redirect_uri in session — skipping mobile flow")
+        return None
+
+    logger.info(
+        "[MOBILE] _create_mobile_redirect: mobile flow detected, redirect_uri=%r",
+        mobile_redirect_uri,
+    )
+
+    user = request.session.get("user") or {}
+    owner_id = user.get("sub") or user.get("preferred_username") or user.get("email") or user.get("id")
+    logger.debug(
+        "[MOBILE] Resolving owner_id from session user: sub=%r preferred_username=%r email=%r id=%r → owner_id=%r",
+        user.get("sub"),
+        user.get("preferred_username"),
+        user.get("email"),
+        user.get("id"),
+        owner_id,
+    )
+    if not owner_id:
+        logger.warning("Mobile SSO redirect requested but no owner_id could be resolved from session")
+        return None
+
+    # Lazy imports to avoid circular dependency via app.api.__init__
+    from app.api.api_tokens import generate_api_token, hash_token
+    from app.models import ApiToken as _ApiToken
+
+    plaintext = generate_api_token()
+    token_hash_value = hash_token(plaintext)
+    prefix = plaintext[:12]
+
+    db_token = _ApiToken(
+        owner_id=owner_id,
+        name="Mobile App",
+        token_hash=token_hash_value,
+        token_prefix=prefix,
+    )
+    try:
+        db.add(db_token)
+        db.commit()
+    except Exception:
+        db.rollback()
+        logger.exception("Failed to create mobile API token for owner_id=%s", owner_id)
+        return None
+
+    # Safely append the token as a query parameter, preserving any existing params.
+    separator = "&" if "?" in mobile_redirect_uri else "?"
+    redirect_url = f"{mobile_redirect_uri}{separator}{urlencode({'token': plaintext})}"
+
+    # Log the full redirect URL at DEBUG so it's visible when debug logging is enabled.
+    # At INFO level, log a sanitised version (scheme + host only, token prefix only)
+    # so the plaintext token is never written to persistent info logs.
+    parsed = urlparse(redirect_url)
+    existing_params = f"&{parsed.query.replace(f'token={plaintext}', '')}" if parsed.query else ""
+    sanitised_url = (
+        f"{parsed.scheme}://{parsed.netloc}{parsed.path}?token={prefix}…[redacted]{existing_params.rstrip('&')}"
+    )
+    logger.info(
+        "[MOBILE] MOBILE_SSO_TOKEN_ISSUED owner=%s token_id=%s redirect_target=%s",
+        owner_id,
+        db_token.id,
+        sanitised_url,
+    )
+    logger.debug(
+        "[MOBILE] Full redirect URL being sent to client: %s",
+        redirect_url,
+    )
+    return RedirectResponse(url=redirect_url, status_code=status.HTTP_302_FOUND)
+
+
 async def auth(request: Request, db: Session = Depends(get_db)):
     """Handle local username/password authentication.
 
@@ -659,8 +942,13 @@ async def auth(request: Request, db: Session = Depends(get_db)):
             )
             return RedirectResponse(url="/login?error=Invalid+username+or+password", status_code=302)
 
+        username_lower = username.lower()
         local_user = (
-            db.query(_LocalUser).filter((_LocalUser.username == username) | (_LocalUser.email == username)).first()
+            db.query(_LocalUser)
+            .filter(
+                (func.lower(_LocalUser.username) == username_lower) | (func.lower(_LocalUser.email) == username_lower)
+            )
+            .first()
         )
         logger.debug(
             "[AUTH] LocalUser lookup: username=%r found=%s",
@@ -691,9 +979,33 @@ async def auth(request: Request, db: Session = Depends(get_db)):
                 return RedirectResponse(url="/login?error=Invalid+username+or+password", status_code=302)
             user_data = _build_session_user(local_user)
             request.session["user"] = user_data
+            # Create server-side session for tracking and revocation
+            try:
+                from app.utils.session_manager import create_session
+
+                user_session = create_session(
+                    db,
+                    user_id=local_user.email,
+                    ip_address=get_client_ip(request),
+                    user_agent=request.headers.get("user-agent"),
+                )
+                request.session["_session_token"] = user_session.session_token
+            except Exception:
+                logger.debug("[AUTH] Failed to create server-side session", exc_info=True)
             logger.info("[SECURITY] LOCAL_LOGIN_SUCCESS user=%s", local_user.email)
             _record_login_event(db, request, local_user.email, success=True)
             _ensure_user_profile(db, user_data, is_admin=bool(local_user.is_admin))
+
+            # Mobile app flow: issue an inline API token and redirect back to the app.
+            logger.debug(
+                "[MOBILE] local auth: checking for mobile redirect (session has mobile_redirect_uri=%s)",
+                "mobile_redirect_uri" in request.session,
+            )
+            mobile_resp = _create_mobile_redirect(request, db)
+            if mobile_resp:
+                logger.info("[MOBILE] local auth: returning mobile redirect response")
+                return mobile_resp
+
             profile = db.query(_UserProfile).filter(_UserProfile.user_id == local_user.email).first()
             if profile and not profile.onboarding_completed:
                 post_onboarding = request.session.pop("redirect_after_login", "/upload")
@@ -718,13 +1030,13 @@ async def auth(request: Request, db: Session = Depends(get_db)):
     logger.debug(
         "[AUTH] Admin credential check: admin_configured=%s username_match=%s multi_user_enabled=%s",
         admin_configured,
-        username == settings.admin_username if admin_configured else False,
+        (username or "").lower() == settings.admin_username.lower() if admin_configured else False,
         settings.multi_user_enabled,
     )
     if (
         settings.admin_username
         and settings.admin_password
-        and username == settings.admin_username
+        and (username or "").lower() == settings.admin_username.lower()
         and password == settings.admin_password
     ):
         admin_user_data = {
@@ -736,9 +1048,34 @@ async def auth(request: Request, db: Session = Depends(get_db)):
             "is_admin": True,
         }
         request.session["user"] = admin_user_data
+        # Create server-side session for tracking and revocation
+        try:
+            from app.utils.session_manager import create_session
+
+            admin_user_id = settings.admin_username or "admin"
+            user_session = create_session(
+                db,
+                user_id=admin_user_id,
+                ip_address=get_client_ip(request),
+                user_agent=request.headers.get("user-agent"),
+            )
+            request.session["_session_token"] = user_session.session_token
+        except Exception:
+            logger.debug("[AUTH] Failed to create server-side session for admin", exc_info=True)
         logger.info("[SECURITY] LOCAL_LOGIN_SUCCESS user=%s", username)
         _record_login_event(db, request, username, success=True)
         _ensure_user_profile(db, admin_user_data, is_admin=True)
+
+        # Mobile app flow: issue an inline API token and redirect back to the app.
+        logger.debug(
+            "[MOBILE] admin auth: checking for mobile redirect (session has mobile_redirect_uri=%s)",
+            "mobile_redirect_uri" in request.session,
+        )
+        mobile_resp = _create_mobile_redirect(request, db)
+        if mobile_resp:
+            logger.info("[MOBILE] admin auth: returning mobile redirect response")
+            return mobile_resp
+
         redirect_url = request.session.pop("redirect_after_login", "/upload")
         return RedirectResponse(url=redirect_url, status_code=302)
     else:
@@ -760,6 +1097,7 @@ async def logout(request: Request, db: Session = Depends(get_db)):
     username = "unknown"
     if isinstance(user, dict):
         username = user.get("preferred_username") or user.get("email") or "unknown"
+    logger.debug("[AUTH] logout: clearing session for user=%s client_ip=%s", username, get_client_ip(request))
     logger.info(f"[SECURITY] LOGOUT user={username}")
     try:
         from app.utils.audit_service import record_event
@@ -774,6 +1112,20 @@ async def logout(request: Request, db: Session = Depends(get_db)):
         )
     except Exception:
         logger.debug("Failed to write logout audit event for user=%s", username, exc_info=True)
+    # Revoke server-side session
+    session_token = request.session.get("_session_token")
+    if session_token:
+        try:
+            from app.utils.session_manager import validate_session
+
+            user_session = validate_session(db, session_token)
+            if user_session:
+                user_session.is_revoked = True
+                user_session.revoked_at = datetime.now(timezone.utc)
+                db.commit()
+        except Exception:
+            logger.debug("[AUTH] Failed to revoke server-side session", exc_info=True)
+    request.session.pop("_session_token", None)
     request.session.pop("user", None)
     return RedirectResponse(url="/login?message=You+have+been+logged+out+successfully", status_code=302)
 

app/celery_app.py

@@ -1,10 +1,15 @@
 # app/celery_app.py
 
+import logging
+import os
+
 from celery import Celery
 from celery.signals import task_failure, worker_ready
 
 from app.config import settings
 
+logger = logging.getLogger(__name__)
+
 celery = Celery(
     "document_processor",
     broker=settings.redis_url,
@@ -21,6 +26,64 @@ celery.conf.task_routes = {
     "app.tasks.*": {"queue": "document_processor"},
 }
 
+# Mapping of document pipeline task names to the positional index of ``file_id``
+# in their ``args`` tuple.  These indices correspond to the task signatures:
+#   process_with_ocr(filename, file_id, ...)          → index 1
+#   extract_metadata_with_gpt(filename, text, file_id) → index 2
+#   embed_metadata_into_pdf(path, text, metadata, file_id) → index 3
+# Tasks that always pass ``file_id`` as a keyword argument
+# (e.g. ``process_document``, ``finalize_document_storage``) are not listed
+# here — their ``file_id`` is found via ``kwargs`` instead.
+_FILE_ID_ARG_INDEX: dict[str, int] = {
+    "app.tasks.process_with_ocr.process_with_ocr": 1,
+    "app.tasks.extract_metadata_with_gpt.extract_metadata_with_gpt": 2,
+    "app.tasks.embed_metadata_into_pdf.embed_metadata_into_pdf": 3,
+}
+
+
+def _dispatch_user_failure_notification(sender, exception, args: list | None, kwargs: dict | None) -> None:
+    """Best-effort per-user failure notification for document pipeline tasks.
+
+    Extracts ``file_id`` from the failed task's arguments, looks up the owning
+    user from the database, and dispatches a ``document.failed`` notification.
+    """
+    from app.database import SessionLocal
+    from app.models import FileRecord
+    from app.utils.user_notification import notify_user_document_failed
+
+    task_name = sender.name if sender else ""
+    if not task_name.startswith("app.tasks."):
+        return
+
+    # 1. Resolve file_id from kwargs or positional args
+    file_id = (kwargs or {}).get("file_id")
+    if file_id is None:
+        idx = _FILE_ID_ARG_INDEX.get(task_name)
+        if idx is not None and args and len(args) > idx:
+            val = args[idx]
+            if isinstance(val, int):
+                file_id = val
+
+    if file_id is None:
+        return
+
+    # 2. Look up owner from the database
+    with SessionLocal() as db:
+        record = db.query(FileRecord).filter(FileRecord.id == file_id).first()
+        if not record or not record.owner_id:
+            return
+        owner_id = record.owner_id
+        filename = record.original_filename or record.local_filename or "unknown"
+
+    # 3. Dispatch per-user notification
+    error_msg = f"{type(exception).__name__}: {exception}" if exception else "Unknown error"
+    notify_user_document_failed(
+        owner_id=owner_id,
+        filename=os.path.basename(filename),
+        error=error_msg,
+        file_id=file_id,
+    )
+
 
 @worker_ready.connect
 def init_sentry_on_worker_ready(**kwargs):
@@ -48,6 +111,10 @@ def task_failure_handler(
                 kwargs=kwargs or {},
             )
         except Exception as e:
-            import logging
+            logger.exception(f"Failed to send task failure notification: {e}")
 
-            logging.exception(f"Failed to send task failure notification: {e}")
+    # Also dispatch a per-user failure notification for document pipeline tasks
+    try:
+        _dispatch_user_failure_notification(sender, exception, args, kwargs)
+    except Exception:
+        logger.warning("Could not dispatch per-user failure notification", exc_info=True)

app/celery_worker.py

@@ -39,6 +39,7 @@ from app.tasks.refine_text_with_gpt import refine_text_with_gpt  # noqa: F401
 from app.tasks.rotate_pdf_pages import rotate_pdf_pages  # noqa: F401
 from app.tasks.send_to_all import send_to_all_destinations  # noqa: F401
 from app.tasks.subscription_tasks import apply_pending_subscription_changes_all  # noqa: F401
+from app.tasks.translate_to_default_language import translate_to_default_language  # noqa: F401
 
 # Import new send tasks
 from app.tasks.upload_to_dropbox import upload_to_dropbox  # noqa: F401
@@ -51,6 +52,7 @@ from app.tasks.upload_to_onedrive import upload_to_onedrive  # noqa: F401
 from app.tasks.upload_to_paperless import upload_to_paperless  # noqa: F401
 from app.tasks.upload_to_s3 import upload_to_s3  # noqa: F401
 from app.tasks.upload_to_sftp import upload_to_sftp  # noqa: F401
+from app.tasks.upload_to_sharepoint import upload_to_sharepoint  # noqa: F401
 from app.tasks.upload_to_user_integration import upload_to_user_integration  # noqa: F401
 from app.tasks.upload_to_webdav import upload_to_webdav  # noqa: F401
 from app.tasks.upload_with_rclone import send_to_all_rclone_destinations, upload_with_rclone  # noqa: F401

app/config.py

@@ -48,6 +48,51 @@ class Settings(BaseSettings):
     workdir: str
     debug: bool = False  # Default to False
 
+    # Logging level for the application.  Accepts standard Python level names:
+    # DEBUG, INFO, WARNING, ERROR, CRITICAL.  When *debug* is True and
+    # *log_level* has not been explicitly set, the effective level is forced to
+    # DEBUG so that all ``logger.debug()`` calls produce output.
+    log_level: str = Field(
+        default="INFO",
+        description=(
+            "Python logging level for the application root logger.  "
+            "Accepts: DEBUG, INFO, WARNING, ERROR, CRITICAL.  "
+            "When DEBUG=True and LOG_LEVEL is not explicitly set, "
+            "the effective level is automatically lowered to DEBUG."
+        ),
+    )
+
+    # Log output format.  ``text`` is the human-readable default.
+    # ``json`` emits one JSON object per line, ideal for log collectors
+    # (Promtail, Fluentd, Filebeat, Datadog agent) and SIEM ingestion.
+    log_format: str = Field(
+        default="text",
+        description=(
+            "Log output format: 'text' (human-readable, default) or "
+            "'json' (structured JSON lines for SIEM / log aggregation)."
+        ),
+    )
+
+    # Optional syslog forwarding for application logs (not just audit events).
+    # When enabled, a Python SysLogHandler is added to the root logger so that
+    # every log message is also sent to the configured syslog receiver.
+    log_syslog_enabled: bool = Field(
+        default=False,
+        description="Forward application logs to a syslog receiver in addition to stdout.",
+    )
+    log_syslog_host: str = Field(
+        default="localhost",
+        description="Hostname or IP of the syslog receiver for application logs.",
+    )
+    log_syslog_port: int = Field(
+        default=514,
+        description="Port of the syslog receiver for application logs.",
+    )
+    log_syslog_protocol: str = Field(
+        default="udp",
+        description="Protocol for syslog transport: 'udp' or 'tcp'.",
+    )
+
     # Making Dropbox optional
     dropbox_enabled: bool = Field(
         default=True,
@@ -121,11 +166,50 @@ class Settings(BaseSettings):
     google_docai_location: str = "us"  # Processor location, e.g. "us" or "eu"
     external_hostname: str = "localhost"  # Default to localhost
 
+    # ---------------------------------------------------------------------------
+    # Document Translation Settings
+    # ---------------------------------------------------------------------------
+    # Default target language for automatic document translation (ISO 639-1 code).
+    # After OCR / metadata extraction, if the detected document language differs
+    # from this value the system translates the extracted text into this language
+    # and stores it alongside the original.  Other language translations are
+    # generated on the fly via the AI provider and are NOT persisted.
+    # Per-user overrides are stored in UserProfile.default_document_language.
+    default_document_language: str = Field(
+        default="en",
+        description=(
+            "ISO 639-1 language code for the default translation target "
+            "(e.g. 'en', 'de', 'fr'). Documents whose detected language "
+            "differs are automatically translated into this language after "
+            "processing. Default: 'en' (English)."
+        ),
+    )
+
     # Authentication settings
     auth_enabled: bool = True  # Default to enabled
     admin_username: Optional[str] = None
     admin_password: Optional[str] = None
     session_secret: Optional[str] = None
+    session_lifetime_days: int = Field(
+        default=30,
+        description=(
+            "Session lifetime in days.  Common values: 30, 60, 90.  "
+            "Determines how long a user stays logged in before being required to re-authenticate.  "
+            "Applies to both browser sessions and the session cookie max_age."
+        ),
+    )
+    session_lifetime_custom_days: int | None = Field(
+        default=None,
+        description=(
+            "Override session_lifetime_days with a custom value.  "
+            "When set, this takes precedence over session_lifetime_days.  "
+            "Useful for admin-configured non-standard durations."
+        ),
+    )
+    qr_login_challenge_ttl_seconds: int = Field(
+        default=120,
+        description="Time-to-live in seconds for QR login challenges (default: 2 minutes).",
+    )
     admin_group_name: str = "admin"
 
     # Multi-user settings
@@ -525,6 +609,15 @@ class Settings(BaseSettings):
     onedrive_refresh_token: Optional[str] = None  # Required for personal accounts
     onedrive_folder_path: Optional[str] = None
 
+    # SharePoint settings
+    sharepoint_client_id: Optional[str] = None
+    sharepoint_client_secret: Optional[str] = None
+    sharepoint_tenant_id: Optional[str] = "common"
+    sharepoint_refresh_token: Optional[str] = None
+    sharepoint_site_url: Optional[str] = None  # e.g. https://tenant.sharepoint.com/sites/sitename
+    sharepoint_document_library: Optional[str] = "Documents"  # Document library name
+    sharepoint_folder_path: Optional[str] = None  # Subfolder inside the library
+
     # AWS S3 settings
     s3_enabled: bool = Field(
         default=True,
@@ -575,6 +668,25 @@ class Settings(BaseSettings):
         ),
     )
 
+    # System reset / factory reset settings
+    factory_reset_on_startup: bool = Field(
+        default=False,
+        description=(
+            "When enabled, DocuElevate wipes all user data (database rows and "
+            "work-files on disk) on every startup so the instance always comes "
+            "up in a clean, fresh state.  Useful for demo or testing environments. "
+            "Default: False."
+        ),
+    )
+    enable_factory_reset: bool = Field(
+        default=False,
+        description=(
+            "Show the 'System Reset' page in the admin UI.  When enabled, "
+            "administrators can trigger a full data wipe or a wipe-and-reimport "
+            "directly from the web interface.  Default: False."
+        ),
+    )
+
     # PDF/A archival conversion settings
     enable_pdfa_conversion: bool = Field(
         default=False,
@@ -1003,6 +1115,45 @@ class Settings(BaseSettings):
         ),
     )
 
+    # Database Connection Pool Configuration
+    # Controls SQLAlchemy QueuePool behaviour for PostgreSQL/MySQL.
+    # SQLite uses NullPool and ignores these settings.
+    db_pool_size: int = Field(
+        default=5,
+        description="Number of persistent connections kept in the pool. Ignored for SQLite.",
+    )
+    db_max_overflow: int = Field(
+        default=10,
+        description=("Maximum number of connections that can be opened beyond db_pool_size. Ignored for SQLite."),
+    )
+    db_pool_timeout: int = Field(
+        default=30,
+        description="Seconds to wait for a connection from the pool before raising an error. Ignored for SQLite.",
+    )
+    db_pool_recycle: int = Field(
+        default=1800,
+        description=(
+            "Seconds after which a connection is recycled to prevent stale connections. "
+            "Ignored for SQLite. Default: 1800 (30 minutes)."
+        ),
+    )
+
+    # Per-user upload rate limiting (health-aware limiter)
+    # Controls how many uploads a single user may submit within a sliding window.
+    upload_rate_limit_per_user: int = Field(
+        default=20,
+        description=(
+            "Maximum number of uploads allowed per user within the upload_rate_limit_window. "
+            "The limiter may dynamically reduce this value when Redis queue depth or CPU load is high."
+        ),
+    )
+    upload_rate_limit_window: int = Field(
+        default=60,
+        description=(
+            "Sliding window in seconds over which upload_rate_limit_per_user is enforced. Default: 60 seconds."
+        ),
+    )
+
     # Rate Limiting Configuration (see SECURITY_AUDIT.md and docs/API.md)
     # Protects against DoS attacks and API abuse
     rate_limiting_enabled: bool = Field(

app/database.py

@@ -10,6 +10,7 @@ from typing import Any
 from sqlalchemy import create_engine, exc
 from sqlalchemy.engine.url import make_url
 from sqlalchemy.orm import Session, declarative_base, sessionmaker
+from sqlalchemy.pool import NullPool, QueuePool
 
 from app.config import settings
 
@@ -19,7 +20,20 @@ Base = declarative_base()
 
 # Parse the DATABASE_URL
 DB_URL = settings.database_url
-engine = create_engine(DB_URL, connect_args={"check_same_thread": False})
+_db_url = make_url(DB_URL)
+if _db_url.get_backend_name() == "sqlite":
+    # SQLite does not benefit from connection pooling; NullPool avoids contention.
+    engine = create_engine(DB_URL, connect_args={"check_same_thread": False}, poolclass=NullPool)
+else:
+    # PostgreSQL / MySQL / other: use a configurable QueuePool.
+    engine = create_engine(
+        DB_URL,
+        poolclass=QueuePool,
+        pool_size=settings.db_pool_size,
+        max_overflow=settings.db_max_overflow,
+        pool_timeout=settings.db_pool_timeout,
+        pool_recycle=settings.db_pool_recycle,
+    )
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
 
 
@@ -210,8 +224,10 @@ def _run_schema_migrations(engine: Any) -> None:
             if unique_filehash_indexes:
                 logger.info("Migrating files: dropping unique index on 'filehash'")
                 with engine.begin() as conn:
+                    preparer = conn.dialect.identifier_preparer
                     for index in unique_filehash_indexes:
-                        conn.execute(text(f"DROP INDEX IF EXISTS {index['name']}"))
+                        quoted_idx = preparer.quote(index["name"])
+                        conn.execute(text(f"DROP INDEX IF EXISTS {quoted_idx}"))
                 logger.info("Migration complete: unique index on 'filehash' removed")
         except Exception as exc:
             logger.warning(f"Skipping filehash unique index drop: {exc}")
@@ -263,12 +279,17 @@ def _ensure_indexes(engine: Any, inspector: Any) -> None:
     table_names = inspector.get_table_names()
     columns_by_table: dict[str, set[str]] = {}
     with engine.begin() as conn:
+        preparer = conn.dialect.identifier_preparer
         for idx_name, table, column in _PERF_INDEXES:
             if table in table_names:
                 if table not in columns_by_table:
                     columns_by_table[table] = {col["name"] for col in inspector.get_columns(table)}
                 if column in columns_by_table[table]:
-                    conn.execute(text(f"CREATE INDEX IF NOT EXISTS {idx_name} ON {table} ({column})"))
+                    # SECURITY: Quoted identifiers to prevent SQL injection during index creation
+                    quoted_idx = preparer.quote(idx_name)
+                    quoted_table = preparer.quote(table)
+                    quoted_col = preparer.quote(column)
+                    conn.execute(text(f"CREATE INDEX IF NOT EXISTS {quoted_idx} ON {quoted_table} ({quoted_col})"))
 
     logger.info("Performance indexes ensured")
 

app/main.py

@@ -1,8 +1,11 @@
 #!/usr/bin/env python3
+import json as _json_mod
 import logging
 import os
 import pathlib
 from contextlib import asynccontextmanager
+from datetime import datetime as _dt
+from datetime import timezone as _tz
 
 from fastapi import FastAPI, HTTPException, Request, status
 from fastapi.middleware.cors import CORSMiddleware
@@ -36,6 +39,114 @@ from app.views import router as frontend_router
 # Explicitly include the files router
 from app.views.files import router as files_router
 
+# ---------------------------------------------------------------------------
+# Configure Python root logging level early so that *all* loggers (including
+# those already created via ``logging.getLogger(__name__)`` in other modules)
+# respect the configured level.
+#
+# Standard behaviour (matches Django, Flask, 12-factor conventions):
+#   • ``LOG_LEVEL`` env var takes precedence when explicitly set.
+#   • When ``DEBUG=True`` and ``LOG_LEVEL`` is **not** set, the effective
+#     level is automatically lowered to ``DEBUG``.
+#   • Default (neither flag set): ``INFO``.
+#
+# ``LOG_FORMAT=json`` enables structured JSON lines on stdout, suitable for
+# Promtail, Fluentd, Filebeat, Datadog, Splunk UF, or any log collector.
+#
+# ``LOG_SYSLOG_ENABLED=true`` adds a Python SysLogHandler so that every log
+# message is also forwarded to the configured syslog receiver — useful for
+# traditional (non-container) deployments and centralised SIEM ingestion.
+#
+# Noisy third-party loggers (httpx, httpcore, authlib, etc.) are pinned to
+# WARNING when the app-level is DEBUG to keep output useful.
+# ---------------------------------------------------------------------------
+_explicit_log_level = os.environ.get("LOG_LEVEL")
+if settings.debug and _explicit_log_level is None:
+    _effective_level = "DEBUG"
+else:
+    _effective_level = settings.log_level.upper()
+
+_effective_level_int = getattr(logging, _effective_level, logging.INFO)
+
+
+class _JsonFormatter(logging.Formatter):
+    """Emit one JSON object per log line for machine consumption.
+
+    Fields emitted: ``timestamp``, ``level``, ``logger``, ``message``,
+    ``module``, ``funcName``, ``lineno``, and — when present — ``exc_info``.
+    Compatible with Grafana Loki, Splunk, ELK, Datadog, and most SIEM tools.
+    """
+
+    def format(self, record: logging.LogRecord) -> str:
+        log_entry: dict = {
+            "timestamp": _dt.fromtimestamp(record.created, tz=_tz.utc).isoformat(),
+            "level": record.levelname,
+            "logger": record.name,
+            "message": record.getMessage(),
+            "module": record.module,
+            "funcName": record.funcName,
+            "lineno": record.lineno,
+        }
+        if record.exc_info and record.exc_info[1] is not None:
+            log_entry["exc_info"] = self.formatException(record.exc_info)
+        return _json_mod.dumps(log_entry, default=str)
+
+
+# Choose formatter based on LOG_FORMAT setting
+if settings.log_format.lower() == "json":
+    _handler = logging.StreamHandler()
+    _handler.setFormatter(_JsonFormatter())
+    logging.root.handlers = [_handler]
+    logging.root.setLevel(_effective_level_int)
+else:
+    logging.basicConfig(
+        level=_effective_level_int,
+        format="%(asctime)s - %(name)s - %(levelname)s - %(message)s",
+        datefmt="%Y-%m-%d %H:%M:%S",
+        force=True,
+    )
+
+# Optional: forward application logs to a syslog receiver
+if settings.log_syslog_enabled:
+    import logging.handlers as _lh
+    import socket as _socket
+
+    _proto = settings.log_syslog_protocol.lower()
+    _socktype = _socket.SOCK_STREAM if _proto == "tcp" else _socket.SOCK_DGRAM
+    _syslog_handler = _lh.SysLogHandler(
+        address=(settings.log_syslog_host, settings.log_syslog_port),
+        socktype=_socktype,
+    )
+    _syslog_handler.setLevel(_effective_level_int)
+    # Use the same formatter as stdout (text or JSON)
+    if settings.log_format.lower() == "json":
+        _syslog_handler.setFormatter(_JsonFormatter())
+    else:
+        _syslog_handler.setFormatter(logging.Formatter("%(name)s - %(levelname)s - %(message)s"))
+    logging.root.addHandler(_syslog_handler)
+
+# Keep noisy third-party loggers quiet at DEBUG level
+if _effective_level_int <= logging.DEBUG:
+    for _noisy in (
+        "httpx",
+        "httpcore",
+        "authlib",
+        "urllib3",
+        "hpack",
+        "multipart",
+        "watchfiles",
+    ):
+        logging.getLogger(_noisy).setLevel(logging.WARNING)
+
+_startup_logger = logging.getLogger(__name__)
+_startup_logger.info(
+    "Root logging level set to %s (debug=%s, format=%s, syslog=%s)",
+    _effective_level,
+    settings.debug,
+    settings.log_format,
+    settings.log_syslog_enabled,
+)
+
 # Load configuration from .env for the session key
 config = Config(".env")
 # Use settings.session_secret which has proper validation
@@ -59,6 +170,12 @@ async def lifespan(app: FastAPI):
     # Startup: Initialize database
     init_db()  # Create tables if they don't exist
 
+    # Factory reset on startup — wipe all user data before anything else
+    if settings.factory_reset_on_startup:
+        from app.utils.system_reset import perform_startup_reset
+
+        perform_startup_reset()
+
     # Load settings from database after DB initialization
     from app.database import SessionLocal
     from app.utils.config_loader import load_settings_from_db
@@ -207,8 +324,19 @@ app.add_middleware(CSRFMiddleware, config=settings)
 #    See SECURITY_AUDIT.md – Infrastructure Security section
 app.add_middleware(AuditLogMiddleware, config=settings)
 
+
 # 3) Session Middleware (for request.session to work)
-app.add_middleware(SessionMiddleware, secret_key=SESSION_SECRET)
+def _get_session_max_age() -> int:
+    """Compute session max-age at startup time."""
+    try:
+        from app.utils.session_manager import get_session_max_age_seconds
+
+        return get_session_max_age_seconds()
+    except Exception:
+        return 30 * 86400  # 30 days default fallback
+
+
+app.add_middleware(SessionMiddleware, secret_key=SESSION_SECRET, max_age=_get_session_max_age())
 
 # 3a) CORS Middleware - handles cross-origin requests and preflight (OPTIONS) responses.
 #     Disabled by default: set CORS_ENABLED=True only when NOT using a reverse proxy
@@ -261,12 +389,14 @@ _error_templates = Jinja2Templates(directory=str(_error_templates_dir))
 # Register the i18n translate helper as a global so error templates can use {{ _("key") }}.
 # Error pages use the default language (English); request-specific locale is not needed here.
 from app.utils.i18n import SUPPORTED_LANGUAGES as _SUPPORTED_LANGUAGES  # noqa: E402
+from app.utils.i18n import get_suggested_languages as _get_suggested_languages  # noqa: E402
 from app.utils.i18n import translate as _translate_fn  # noqa: E402
 
 _error_templates.env.globals["_"] = lambda key, **kwargs: _translate_fn(key, "en", **kwargs)
 _error_templates.env.globals["min"] = min
 _error_templates.env.globals["max"] = max
 _error_templates.env.globals["supported_languages"] = _SUPPORTED_LANGUAGES
+_error_templates.env.globals["suggested_languages"] = _get_suggested_languages("en", "")
 
 
 @app.exception_handler(HTTPException)

app/middleware/csrf.py

@@ -20,6 +20,9 @@ How it works:
 
 Exempt paths (CSRF is not checked even for state-changing methods):
 - ``/oauth-callback`` – OAuth 2.0 callback; protected by the ``state`` parameter.
+- ``/api/qr-auth/claim`` – Called by the unauthenticated mobile app; the
+  cryptographically-random, single-use challenge token provides equivalent
+  protection.
 """
 
 import logging
@@ -39,6 +42,10 @@ CSRF_PROTECTED_METHODS = {"POST", "PUT", "DELETE", "PATCH"}
 # their own replay-protection mechanism).
 CSRF_EXEMPT_PATHS = {
     "/oauth-callback",
+    # The mobile app calls this endpoint without a browser session/CSRF token.
+    # The cryptographically-random, single-use challenge token already provides
+    # equivalent protection against cross-site request forgery.
+    "/api/qr-auth/claim",
 }
 
 

app/models.py

@@ -84,6 +84,19 @@ class FileRecord(Base):
     # Processing pipeline assigned to this file (NULL = use system default)
     pipeline_id = Column(Integer, ForeignKey(_PIPELINES_ID_FK), nullable=True, index=True)
 
+    # Detected document language (ISO 639-1 code, e.g. "de", "en", "fr")
+    # Extracted from AI metadata during processing; cached here for fast access.
+    detected_language = Column(String(10), nullable=True)
+
+    # Default-language translation of the extracted text.
+    # Stored when the detected language differs from the user's/system default
+    # document language.  Only the original text and this translation are persisted;
+    # other languages are translated on the fly via the AI provider.
+    default_language_text = Column(Text, nullable=True)
+
+    # ISO 639-1 code of the default-language translation stored above (e.g. "en").
+    default_language_code = Column(String(10), nullable=True)
+
     # Timestamp when we inserted this record
     created_at = Column(DateTime(timezone=True), server_default=func.now(), index=True)
 
@@ -282,6 +295,12 @@ class UserProfile(Base):
     # NULL means "auto-detect from browser Accept-Language header"
     preferred_language = Column(String(10), nullable=True)
 
+    # Default document language for translated versions (ISO 639-1 code).
+    # When a document's detected language differs from this value, the system
+    # automatically generates and stores a translation into this language.
+    # NULL means "use the global DEFAULT_DOCUMENT_LANGUAGE setting".
+    default_document_language = Column(String(10), nullable=True)
+
     # UI colour scheme preference: "light" | "dark" | "system" (NULL = "system")
     preferred_theme = Column(String(10), nullable=True)
 
@@ -584,6 +603,7 @@ class IntegrationType:
     EMAIL = "EMAIL"
     PAPERLESS = "PAPERLESS"
     RCLONE = "RCLONE"
+    SHAREPOINT = "SHAREPOINT"
     ICLOUD = "ICLOUD"
 
     ALL = {
@@ -601,6 +621,7 @@ class IntegrationType:
         EMAIL,
         PAPERLESS,
         RCLONE,
+        SHAREPOINT,
         ICLOUD,
     }
 
@@ -950,6 +971,86 @@ class MobileDevice(Base):
     __table_args__ = (UniqueConstraint("owner_id", "push_token", name="uq_mobile_device_owner_token"),)
 
 
+class UserSession(Base):
+    """Server-side session tracking for invalidation and device management.
+
+    Each row represents an active browser or app session.  The ``session_token``
+    is stored in the user's cookie and validated on every authenticated request.
+    Revoking a row (``is_revoked=True``) immediately terminates that session
+    on the next request.
+    """
+
+    __tablename__ = "user_sessions"
+
+    id = Column(Integer, primary_key=True, index=True)
+
+    # Cryptographically random token stored in the session cookie.
+    session_token = Column(String(128), unique=True, nullable=False, index=True)
+
+    # Stable owner identifier — matches FileRecord.owner_id.
+    user_id = Column(String, nullable=False, index=True)
+
+    # Client metadata for display in the session management UI.
+    ip_address = Column(String(45), nullable=True)
+    user_agent = Column(String(512), nullable=True)
+    device_info = Column(String(255), nullable=True)
+
+    is_revoked = Column(Boolean, nullable=False, default=False)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+    last_active_at = Column(DateTime(timezone=True), server_default=func.now())
+    expires_at = Column(DateTime(timezone=True), nullable=False)
+    revoked_at = Column(DateTime(timezone=True), nullable=True)
+
+
+class QRLoginChallenge(Base):
+    """Time-limited QR code login challenge for mobile app authentication.
+
+    A logged-in web user generates a challenge that produces a QR code.  The
+    mobile app scans the QR code and calls the claim endpoint with the
+    ``challenge_token``.  The server verifies the challenge is still valid,
+    unclaimed, and unexpired, then issues an API token for the mobile app.
+
+    Security properties:
+    * Time-bound (default 2 minutes).
+    * Single-use (``is_claimed`` prevents replay).
+    * Cryptographically random 64-byte token.
+    * Bound to the creating user — only that user's mobile device receives a
+      token.
+    """
+
+    __tablename__ = "qr_login_challenges"
+
+    id = Column(Integer, primary_key=True, index=True)
+
+    # Cryptographically random token encoded in the QR code.
+    challenge_token = Column(String(128), unique=True, nullable=False, index=True)
+
+    # The user who created this challenge (from the web session).
+    user_id = Column(String, nullable=False, index=True)
+
+    # Whether the challenge has been successfully claimed by a mobile app.
+    is_claimed = Column(Boolean, nullable=False, default=False)
+
+    # Whether the challenge has been explicitly cancelled or expired.
+    is_cancelled = Column(Boolean, nullable=False, default=False)
+
+    # IP address of the web client that created the challenge.
+    created_by_ip = Column(String(45), nullable=True)
+
+    # IP address of the mobile client that claimed the challenge.
+    claimed_by_ip = Column(String(45), nullable=True)
+
+    # Device name provided by the mobile app when claiming.
+    device_name = Column(String(255), nullable=True)
+
+    # The API token ID that was issued to the mobile app (for audit trail).
+    issued_token_id = Column(Integer, nullable=True)
+
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+    expires_at = Column(DateTime(timezone=True), nullable=False)
+    claimed_at = Column(DateTime(timezone=True), nullable=True)
+
+
 class ComplianceTemplate(Base):
     """Pre-built compliance configuration templates (GDPR, HIPAA, SOC2).
 

app/tasks/embed_metadata_into_pdf.py

@@ -216,6 +216,30 @@ def embed_metadata_into_pdf(self, local_file_path: str, extracted_text: str, met
                     except Exception as search_exc:
                         logger.warning(f"[{task_id}] Meilisearch indexing failed (non-fatal): {search_exc}")
 
+                    # Cache the detected language on the FileRecord and trigger
+                    # default-language translation when the document is in a
+                    # different language.
+                    detected_lang = metadata.get("language") if metadata else None
+                    if detected_lang and extracted_text:
+                        try:
+                            file_record.detected_language = detected_lang
+                            db.commit()
+
+                            from app.tasks.translate_to_default_language import translate_to_default_language
+
+                            translate_to_default_language.delay(
+                                file_id,
+                                extracted_text,
+                                detected_lang,
+                                owner_id=file_record.owner_id,
+                            )
+                            logger.info(
+                                f"[{task_id}] Queued default-language translation for file {file_id} "
+                                f"(detected: {detected_lang})"
+                            )
+                        except Exception as trans_exc:
+                            logger.warning(f"[{task_id}] Could not queue translation task (non-fatal): {trans_exc}")
+
         # Persist the metadata into a JSON file with the same base name.
         # Include file path references for traceability
         logger.info(f"[{task_id}] Persisting metadata to JSON")

app/tasks/finalize_document_storage.py

@@ -21,8 +21,9 @@ from app.tasks.send_to_all import (
 # Import database and logging utils from main
 from app.utils import log_task_progress
 
-# Import notification utility
+# Import notification utilities
 from app.utils.notification import notify_file_processed
+from app.utils.user_notification import notify_user_document_processed
 
 logger = logging.getLogger(__name__)
 
@@ -139,4 +140,15 @@ def finalize_document_storage(self, original_file: str, processed_file: str, met
     except Exception as e:
         logger.warning(f"[WARNING] Failed to send file processed notification: {e}")
 
+    # 6. Send per-user notification
+    if owner_id:
+        try:
+            notify_user_document_processed(
+                owner_id=owner_id,
+                filename=os.path.basename(processed_file),
+                file_id=file_id,
+            )
+        except Exception as e:
+            logger.warning(f"[WARNING] Failed to send per-user processed notification: {e}")
+
     return {"status": "Completed", "file": processed_file}

app/tasks/imap_tasks.py

@@ -18,6 +18,7 @@ from app.utils.allowed_types import (
     DEFAULT_CATEGORIES,
     get_allowed_types_for_categories,
 )
+from app.utils.network import is_private_ip
 
 # Database session for per-user IMAP accounts (imported lazily to avoid circular imports)
 _db_session_factory = None
@@ -405,6 +406,11 @@ def pull_inbox(
     )
     processed_emails = load_processed_emails()
 
+    # Security: Prevent SSRF by blocking connections to internal IPs
+    if is_private_ip(host):
+        logger.warning("SSRF blocked: Attempt to pull mailbox from private IP %s", host)
+        return
+
     try:
         mail = imaplib.IMAP4_SSL(host, port) if use_ssl else imaplib.IMAP4(host, port)
         mail.login(username, password)

app/tasks/send_to_all.py

@@ -18,6 +18,7 @@ from app.tasks.upload_to_onedrive import upload_to_onedrive
 from app.tasks.upload_to_paperless import upload_to_paperless
 from app.tasks.upload_to_s3 import upload_to_s3
 from app.tasks.upload_to_sftp import upload_to_sftp
+from app.tasks.upload_to_sharepoint import upload_to_sharepoint
 from app.tasks.upload_to_webdav import upload_to_webdav
 from app.utils.config_validator import get_provider_status
 from app.utils.logging import log_task_progress
@@ -121,6 +122,18 @@ def _should_upload_to_icloud():
     return bool(getattr(settings, "icloud_enabled", True) and settings.icloud_username and settings.icloud_password)
 
 
+def _should_upload_to_sharepoint():
+    return bool(
+        settings.sharepoint_client_id
+        and settings.sharepoint_client_secret
+        and settings.sharepoint_site_url
+        and (
+            settings.sharepoint_refresh_token
+            or (settings.sharepoint_tenant_id and settings.sharepoint_tenant_id != "common")
+        )
+    )
+
+
 def get_configured_services_from_validator():
     """
     Use the config validator to determine which services are configured and enabled.
@@ -140,6 +153,7 @@ def get_configured_services_from_validator():
         "Email": "email",
         "OneDrive": "onedrive",
         "S3 Storage": "s3",
+        "SharePoint": "sharepoint",
         "iCloud Drive": "icloud",
     }
 
@@ -250,6 +264,11 @@ def send_to_all_destinations(self, file_path: str, use_validator=True, file_id:
             "should_upload": _should_upload_to_s3,
             "upload_func": upload_to_s3,
         },
+        {
+            "name": "sharepoint",
+            "should_upload": _should_upload_to_sharepoint,
+            "upload_func": upload_to_sharepoint,
+        },
         {
             "name": "icloud",
             "should_upload": _should_upload_to_icloud,

app/tasks/translate_to_default_language.py

@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+"""Celery task to translate extracted document text into the default target language.
+
+This task is triggered after metadata extraction when the detected document
+language differs from the user's (or system) default document language.  The
+translated text is persisted in ``FileRecord.default_language_text`` so that
+users can always read a reference copy in their preferred language.
+
+Other ad-hoc translations are generated on the fly via the ``/api/files/{id}/translate``
+endpoint and are NOT persisted.
+"""
+
+import logging
+
+from app.celery_app import celery
+from app.config import settings
+from app.database import SessionLocal
+from app.models import FileRecord, UserProfile
+from app.tasks.retry_config import BaseTaskWithRetry
+from app.utils import log_task_progress
+from app.utils.ai_provider import get_ai_provider
+
+logger = logging.getLogger(__name__)
+
+
+def _resolve_default_language(owner_id: str | None) -> str:
+    """Return the default document language for the given owner.
+
+    Resolution order:
+    1. ``UserProfile.default_document_language`` (per-user override)
+    2. ``settings.default_document_language`` (global setting)
+    """
+    if owner_id:
+        with SessionLocal() as db:
+            profile = db.query(UserProfile).filter_by(user_id=owner_id).first()
+            if profile and profile.default_document_language:
+                return profile.default_document_language
+    return settings.default_document_language
+
+
+@celery.task(base=BaseTaskWithRetry, bind=True)
+def translate_to_default_language(
+    self,
+    file_id: int,
+    extracted_text: str,
+    detected_language: str,
+    owner_id: str | None = None,
+) -> dict:
+    """Translate *extracted_text* into the default document language and persist the result.
+
+    Args:
+        file_id: Primary key of the :class:`FileRecord`.
+        extracted_text: The OCR / refined text in the document's original language.
+        detected_language: ISO 639-1 code of the document's detected language.
+        owner_id: Owner identifier used to resolve per-user language preference.
+
+    Returns:
+        A dict with ``status``, ``target_language``, and the translated text length.
+    """
+    task_id = self.request.id
+    target_language = _resolve_default_language(owner_id)
+
+    # Nothing to do when the document is already in the target language.
+    if detected_language == target_language:
+        logger.info(
+            f"[{task_id}] Document {file_id} already in target language '{target_language}', skipping translation"
+        )
+        log_task_progress(
+            task_id,
+            "translate_to_default_language",
+            "skipped",
+            f"Document already in {target_language}",
+            file_id=file_id,
+        )
+        return {"status": "skipped", "reason": "already_in_target_language"}
+
+    logger.info(f"[{task_id}] Translating document {file_id} from '{detected_language}' to '{target_language}'")
+    log_task_progress(
+        task_id,
+        "translate_to_default_language",
+        "in_progress",
+        f"Translating from {detected_language} to {target_language}",
+        file_id=file_id,
+    )
+
+    try:
+        provider = get_ai_provider()
+        model = settings.ai_model or settings.openai_model
+        translated_text = provider.chat_completion(
+            messages=[
+                {
+                    "role": "system",
+                    "content": (
+                        f"You are a professional translator. Translate the following text "
+                        f"from {detected_language} to {target_language}. "
+                        f"Preserve the original formatting, paragraph structure, and meaning. "
+                        f"Do not add any commentary or explanation — output ONLY the translated text."
+                    ),
+                },
+                {"role": "user", "content": extracted_text},
+            ],
+            model=model,
+            temperature=0.3,
+        )
+
+        # Persist the translation.
+        with SessionLocal() as db:
+            record = db.query(FileRecord).filter_by(id=file_id).first()
+            if record:
+                record.default_language_text = translated_text
+                record.default_language_code = target_language
+                record.detected_language = detected_language
+                db.commit()
+                logger.info(
+                    f"[{task_id}] Stored default-language translation ({len(translated_text)} chars) for file {file_id}"
+                )
+
+        log_task_progress(
+            task_id,
+            "translate_to_default_language",
+            "success",
+            f"Translated {len(extracted_text)} → {len(translated_text)} chars ({detected_language} → {target_language})",
+            file_id=file_id,
+        )
+
+        return {
+            "status": "success",
+            "target_language": target_language,
+            "translated_length": len(translated_text),
+        }
+
+    except Exception as exc:
+        logger.exception(f"[{task_id}] Translation failed for file {file_id}: {exc}")
+        log_task_progress(
+            task_id,
+            "translate_to_default_language",
+            "failure",
+            f"Exception: {exc}",
+            file_id=file_id,
+        )
+        raise

app/tasks/upload_to_email.py

@@ -11,6 +11,7 @@ from email.mime.image import MIMEImage
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 
+import pypdf
 from jinja2 import Environment, FileSystemLoader, select_autoescape
 
 from app.celery_app import celery
@@ -23,6 +24,15 @@ logger = logging.getLogger(__name__)
 # Constants
 _LOGO_FILENAME = "logo.png"
 
+# Mapping from PDF metadata keys (with leading slash stripped) to application-specific names.
+# This mirrors the inverse of the mapping used in app/tasks/embed_metadata_into_pdf.py.
+_PDF_METADATA_KEY_MAP = {
+    "Title": "filename",
+    "Author": "absender",
+    "Subject": "document_type",
+    "Keywords": "tags",
+}
+
 
 def get_email_template(template_name="default.html"):
     """
@@ -63,9 +73,12 @@ def extract_metadata_from_file(file_path):
     """
     Try to extract metadata from a file using several methods:
     1. Check for a .json metadata file with the same name
-    2. Extract metadata from PDF if it's embedded
+    2. Extract embedded metadata from PDF using pypdf
 
-    Returns a dictionary of metadata or None if not found
+    JSON metadata takes precedence; embedded PDF metadata fills in any missing
+    fields using the application's standard key mapping (e.g., /Title → filename).
+
+    Returns a dictionary of metadata (may be empty if none found).
     """
     metadata = {}
 
@@ -76,12 +89,28 @@ def extract_metadata_from_file(file_path):
             with open(metadata_path, "r", encoding="utf-8") as f:
                 metadata = json.load(f)
                 logger.info(f"Loaded metadata from external JSON file: {metadata_path}")
-                return metadata
         except Exception as e:
             logger.warning(f"Failed to load metadata from JSON file: {str(e)}")
 
-    # TODO: For PDF files, try to extract embedded metadata using PyPDF2
-    # This would require additional dependencies, so for now we'll just check for external JSON
+    # Try to extract embedded metadata from PDF
+    if file_path.lower().endswith(".pdf") and os.path.exists(file_path):
+        try:
+            with open(file_path, "rb") as f:
+                pdf_reader = pypdf.PdfReader(f)
+                pdf_metadata = pdf_reader.metadata
+                if pdf_metadata:
+                    for key, value in pdf_metadata.items():
+                        # Remove the leading slash from PDF metadata keys (e.g., '/Title' -> 'Title')
+                        clean_key = key[1:] if key.startswith("/") else key
+                        # Map to application-specific key names where possible
+                        mapped_key = _PDF_METADATA_KEY_MAP.get(clean_key, clean_key)
+                        # Only set if not already present (JSON metadata takes precedence)
+                        if mapped_key not in metadata:
+                            metadata[mapped_key] = str(value)
+
+                    logger.info(f"Extracted embedded metadata from PDF: {file_path}")
+        except Exception as e:
+            logger.warning(f"Failed to extract metadata from PDF {file_path}: {str(e)}")
 
     return metadata
 

app/tasks/upload_to_nextcloud.py

@@ -1,157 +1,141 @@
-#!/usr/bin/env python3
-
-import logging
-import os
-
-import requests
-from requests.auth import HTTPBasicAuth
-
-from app.celery_app import celery
-from app.config import settings
-from app.tasks.retry_config import UploadTaskWithRetry
-from app.utils import log_task_progress
-from app.utils.filename_utils import extract_remote_path, get_unique_filename
-
-logger = logging.getLogger(__name__)
-
-
-@celery.task(base=UploadTaskWithRetry, bind=True)
-def upload_to_nextcloud(self, file_path: str, file_id: int = None, folder_override: str = None):
-    """
-    Upload a file to Nextcloud WebDAV.
-
-    Args:
-        file_path: Path to the file to upload
-        file_id: Optional file ID to associate with logs
-    """
-    task_id = self.request.id
-    logger.info(f"[{task_id}] Starting Nextcloud upload: {file_path}")
-    log_task_progress(
-        task_id,
-        "upload_to_nextcloud",
-        "in_progress",
-        f"Uploading to Nextcloud: {os.path.basename(file_path)}",
-        file_id=file_id,
-    )
-
-    if not os.path.exists(file_path):
-        error_msg = f"File not found: {file_path}"
-        logger.error(f"[{task_id}] {error_msg}")
-        log_task_progress(task_id, "upload_to_nextcloud", "failure", error_msg, file_id=file_id)
-        raise FileNotFoundError(error_msg)
-
-    # For Nextcloud, we need to check for 'nextcloud_upload_url' instead of 'nextcloud_url'
-    # This is what's shown in your env view
-    if not (
-        getattr(settings, "nextcloud_upload_url", None)
-        and getattr(settings, "nextcloud_username", None)
-        and getattr(settings, "nextcloud_password", None)
-    ):
-        logger.info(f"[{task_id}] Nextcloud upload skipped: Missing configuration")
-        log_task_progress(task_id, "upload_to_nextcloud", "success", "Skipped: Not configured", file_id=file_id)
-        return {"status": "Skipped", "reason": "Nextcloud settings not configured"}
-
-    filename = os.path.basename(file_path)
-
-    try:
-        # Prepare WebDAV URL - use nextcloud_upload_url instead of nextcloud_url
-        webdav_url = settings.nextcloud_upload_url
-        if not webdav_url.endswith("/"):
-            webdav_url += "/"
-
-        # Calculate remote path based on local file structure
-        remote_base = (
-            folder_override if folder_override is not None else (getattr(settings, "nextcloud_folder", "") or "")
-        )
-        remote_path = extract_remote_path(file_path, settings.workdir, remote_base)
-        full_url = f"{webdav_url}/{remote_path}"
-
-        # Remove any double slashes (except in http://)
-        full_url = full_url.replace("://", "$PLACEHOLDER$")
-        while "//" in full_url:
-            full_url = full_url.replace("//", "/")
-        full_url = full_url.replace("$PLACEHOLDER$", "://")
-
-        # Function to check if file exists in Nextcloud
-        def check_exists_in_nextcloud(path):
-            check_url = f"{webdav_url}{os.path.dirname(path)}"
-            try:
-                response = requests.request(
-                    "PROPFIND",
-                    check_url,
-                    auth=HTTPBasicAuth(settings.nextcloud_username, settings.nextcloud_password),
-                    headers={"Depth": "1"},
-                    timeout=10,
-                )
-
-                return path in response.text
-            except Exception:
-                # If we can't check, assume it doesn't exist
-                return False
-
-        # Check for potential file collision and get a unique name if needed
-        remote_path = get_unique_filename(remote_path, check_exists_in_nextcloud)
-        full_url = f"{webdav_url}/{remote_path}"
-
-        # Fix double slashes again
-        full_url = full_url.replace("://", "$PLACEHOLDER$")
-        while "//" in full_url:
-            full_url = full_url.replace("//", "/")
-        full_url = full_url.replace("$PLACEHOLDER$", "://")
-
-        # Create necessary parent folders
-        parent_dirs = os.path.dirname(remote_path)
-        if parent_dirs:
-            current_path = ""
-            for folder in parent_dirs.split("/"):
-                if not folder:
-                    continue
-                current_path += f"{folder}/"
-                mkdir_url = f"{webdav_url}/{current_path}"
-                # Fix double slashes
-                mkdir_url = mkdir_url.replace("://", "$PLACEHOLDER$")
-                while "//" in mkdir_url:
-                    mkdir_url = mkdir_url.replace("//", "/")
-                mkdir_url = mkdir_url.replace("$PLACEHOLDER$", "://")
-
-                requests.request(
-                    "MKCOL",
-                    mkdir_url,
-                    auth=HTTPBasicAuth(settings.nextcloud_username, settings.nextcloud_password),
-                    timeout=10,
-                )
-
-        # Upload the file
-        logger.info(f"[{task_id}] Uploading {filename} to Nextcloud at {full_url}")
-        log_task_progress(task_id, "upload_file", "in_progress", f"Uploading to {remote_path}", file_id=file_id)
-        with open(file_path, "rb") as file_data:
-            response = requests.put(
-                full_url,
-                data=file_data,
-                auth=HTTPBasicAuth(settings.nextcloud_username, settings.nextcloud_password),
-                headers={"Content-Type": "application/octet-stream"},
-                timeout=settings.http_request_timeout,  # Use configured timeout for large files
-            )
-
-        if response.status_code in (201, 204):  # Created or No Content
-            logger.info(f"[{task_id}] Successfully uploaded {filename} to Nextcloud at {remote_path}")
-            log_task_progress(
-                task_id, "upload_to_nextcloud", "success", f"Uploaded to Nextcloud: {remote_path}", file_id=file_id
-            )
-            return {
-                "status": "Completed",
-                "file_path": file_path,
-                "nextcloud_path": remote_path,
-                "response_code": response.status_code,
-            }
-        else:
-            error_msg = f"Failed to upload {filename} to Nextcloud: {response.status_code} - {response.text}"
-            logger.error(f"[{task_id}] {error_msg}")
-            log_task_progress(task_id, "upload_to_nextcloud", "failure", error_msg, file_id=file_id)
-            raise Exception(error_msg)
-
-    except Exception as e:
-        error_msg = f"Failed to upload {filename} to Nextcloud: {str(e)}"
-        logger.error(f"[{task_id}] {error_msg}")
-        log_task_progress(task_id, "upload_to_nextcloud", "failure", error_msg, file_id=file_id)
-        raise Exception(error_msg)
+#!/usr/bin/env python3
+
+import logging
+import os
+
+import requests
+from requests.auth import HTTPBasicAuth
+
+from app.celery_app import celery
+from app.config import settings
+from app.tasks.retry_config import UploadTaskWithRetry
+from app.utils import log_task_progress
+from app.utils.filename_utils import extract_remote_path, get_unique_filename
+from app.utils.network import join_url
+
+logger = logging.getLogger(__name__)
+
+
+@celery.task(base=UploadTaskWithRetry, bind=True)
+def upload_to_nextcloud(self, file_path: str, file_id: int = None, folder_override: str = None):
+    """
+    Upload a file to Nextcloud WebDAV.
+
+    Args:
+        file_path: Path to the file to upload
+        file_id: Optional file ID to associate with logs
+    """
+    task_id = self.request.id
+    logger.info(f"[{task_id}] Starting Nextcloud upload: {file_path}")
+    log_task_progress(
+        task_id,
+        "upload_to_nextcloud",
+        "in_progress",
+        f"Uploading to Nextcloud: {os.path.basename(file_path)}",
+        file_id=file_id,
+    )
+
+    if not os.path.exists(file_path):
+        error_msg = f"File not found: {file_path}"
+        logger.error(f"[{task_id}] {error_msg}")
+        log_task_progress(task_id, "upload_to_nextcloud", "failure", error_msg, file_id=file_id)
+        raise FileNotFoundError(error_msg)
+
+    # For Nextcloud, we need to check for 'nextcloud_upload_url' instead of 'nextcloud_url'
+    # This is what's shown in your env view
+    if not (
+        getattr(settings, "nextcloud_upload_url", None)
+        and getattr(settings, "nextcloud_username", None)
+        and getattr(settings, "nextcloud_password", None)
+    ):
+        logger.info(f"[{task_id}] Nextcloud upload skipped: Missing configuration")
+        log_task_progress(task_id, "upload_to_nextcloud", "success", "Skipped: Not configured", file_id=file_id)
+        return {"status": "Skipped", "reason": "Nextcloud settings not configured"}
+
+    filename = os.path.basename(file_path)
+
+    try:
+        # Prepare WebDAV URL - use nextcloud_upload_url instead of nextcloud_url
+        webdav_url = settings.nextcloud_upload_url
+        if not webdav_url.endswith("/"):
+            webdav_url += "/"
+
+        # Calculate remote path based on local file structure
+        remote_base = (
+            folder_override if folder_override is not None else (getattr(settings, "nextcloud_folder", "") or "")
+        )
+        remote_path = extract_remote_path(file_path, settings.workdir, remote_base)
+        full_url = join_url(webdav_url, remote_path)
+
+        # Function to check if file exists in Nextcloud
+        def check_exists_in_nextcloud(path):
+            check_url = join_url(webdav_url, os.path.dirname(path))
+            try:
+                response = requests.request(
+                    "PROPFIND",
+                    check_url,
+                    auth=HTTPBasicAuth(settings.nextcloud_username, settings.nextcloud_password),
+                    headers={"Depth": "1"},
+                    timeout=10,
+                )
+
+                return path in response.text
+            except Exception:
+                # If we can't check, assume it doesn't exist
+                return False
+
+        # Check for potential file collision and get a unique name if needed
+        remote_path = get_unique_filename(remote_path, check_exists_in_nextcloud)
+        full_url = join_url(webdav_url, remote_path)
+
+        # Create necessary parent folders
+        parent_dirs = os.path.dirname(remote_path)
+        if parent_dirs:
+            current_path = ""
+            for folder in parent_dirs.split("/"):
+                if not folder:
+                    continue
+                current_path += f"{folder}/"
+                mkdir_url = join_url(webdav_url, current_path)
+
+                requests.request(
+                    "MKCOL",
+                    mkdir_url,
+                    auth=HTTPBasicAuth(settings.nextcloud_username, settings.nextcloud_password),
+                    timeout=10,
+                )
+
+        # Upload the file
+        logger.info(f"[{task_id}] Uploading {filename} to Nextcloud at {full_url}")
+        log_task_progress(task_id, "upload_file", "in_progress", f"Uploading to {remote_path}", file_id=file_id)
+        with open(file_path, "rb") as file_data:
+            response = requests.put(
+                full_url,
+                data=file_data,
+                auth=HTTPBasicAuth(settings.nextcloud_username, settings.nextcloud_password),
+                headers={"Content-Type": "application/octet-stream"},
+                timeout=settings.http_request_timeout,  # Use configured timeout for large files
+            )
+
+        if response.status_code in (201, 204):  # Created or No Content
+            logger.info(f"[{task_id}] Successfully uploaded {filename} to Nextcloud at {remote_path}")
+            log_task_progress(
+                task_id, "upload_to_nextcloud", "success", f"Uploaded to Nextcloud: {remote_path}", file_id=file_id
+            )
+            return {
+                "status": "Completed",
+                "file_path": file_path,
+                "nextcloud_path": remote_path,
+                "response_code": response.status_code,
+            }
+        else:
+            error_msg = f"Failed to upload {filename} to Nextcloud: {response.status_code} - {response.text}"
+            logger.error(f"[{task_id}] {error_msg}")
+            log_task_progress(task_id, "upload_to_nextcloud", "failure", error_msg, file_id=file_id)
+            raise Exception(error_msg)
+
+    except Exception as e:
+        error_msg = f"Failed to upload {filename} to Nextcloud: {str(e)}"
+        logger.error(f"[{task_id}] {error_msg}")
+        log_task_progress(task_id, "upload_to_nextcloud", "failure", error_msg, file_id=file_id)
+        raise Exception(error_msg)

app/tasks/upload_to_sharepoint.py

@@ -0,0 +1,338 @@
+#!/usr/bin/env python3
+"""Upload documents to Microsoft SharePoint via the Microsoft Graph API.
+
+This module authenticates using MSAL (same OAuth2 flow as OneDrive) and
+uploads files to a configurable SharePoint Online document library using
+the chunked upload session approach for reliability with large files.
+
+Key differences from the OneDrive provider:
+- Uses ``/sites/{siteId}/drives/{driveId}`` instead of ``/me/drive``
+- Requires a SharePoint site URL to resolve the site and drive IDs
+- Targets a named document library (default: ``Documents``)
+"""
+
+import logging
+import os
+import time
+import urllib.parse
+
+import msal
+import requests
+
+from app.celery_app import celery
+from app.config import settings
+from app.tasks.retry_config import UploadTaskWithRetry
+from app.utils import log_task_progress
+
+logger = logging.getLogger(__name__)
+
+
+def get_sharepoint_token() -> str:
+    """Acquire a Microsoft Graph API access token for SharePoint.
+
+    Uses MSAL ``ConfidentialClientApplication`` with the refresh-token flow
+    (delegated permissions) or the client-credentials flow (application
+    permissions) depending on configuration.
+
+    Returns:
+        A valid access token string.
+
+    Raises:
+        ValueError: When required settings are missing or token acquisition fails.
+    """
+    if not settings.sharepoint_client_id or not settings.sharepoint_client_secret:
+        raise ValueError("SharePoint client ID and client secret must be configured")
+
+    tenant = settings.sharepoint_tenant_id or "common"
+    logger.info("Using SharePoint tenant: %s", tenant)
+
+    scopes = ["https://graph.microsoft.com/.default"]
+
+    if settings.sharepoint_refresh_token:
+        app = msal.ConfidentialClientApplication(
+            client_id=settings.sharepoint_client_id,
+            client_credential=settings.sharepoint_client_secret,
+            authority=f"https://login.microsoftonline.com/{tenant}",
+        )
+
+        logger.info("Attempting to acquire SharePoint token using refresh token")
+        token_response = app.acquire_token_by_refresh_token(
+            refresh_token=settings.sharepoint_refresh_token, scopes=scopes
+        )
+
+        if "access_token" not in token_response:
+            error = token_response.get("error", "")
+            error_desc = token_response.get("error_description", "Unknown error")
+            logger.error("Failed to get SharePoint access token: %s - %s", error, error_desc)
+            raise ValueError(f"Failed to get SharePoint access token: {error} - {error_desc}")
+
+        if "refresh_token" in token_response:
+            settings.sharepoint_refresh_token = token_response["refresh_token"]
+            logger.info("Updated SharePoint refresh token in memory")
+
+        return token_response["access_token"]
+
+    elif settings.sharepoint_tenant_id and settings.sharepoint_tenant_id != "common":
+        authority = f"https://login.microsoftonline.com/{settings.sharepoint_tenant_id}"
+        app = msal.ConfidentialClientApplication(
+            client_id=settings.sharepoint_client_id,
+            client_credential=settings.sharepoint_client_secret,
+            authority=authority,
+        )
+
+        token_response = app.acquire_token_for_client(scopes=scopes)
+
+        if "access_token" not in token_response:
+            error = token_response.get("error", "")
+            error_desc = token_response.get("error_description", "Unknown error")
+            raise ValueError(f"Failed to get SharePoint access token: {error} - {error_desc}")
+
+        return token_response["access_token"]
+
+    else:
+        raise ValueError("For SharePoint, either a refresh token or a non-'common' tenant ID is required")
+
+
+def resolve_sharepoint_drive(access_token: str, site_url: str, library_name: str) -> tuple[str, str]:
+    """Resolve the Graph API site ID and drive ID for a SharePoint site.
+
+    Args:
+        access_token: Valid Microsoft Graph API token.
+        site_url: Full SharePoint site URL, e.g.
+            ``https://tenant.sharepoint.com/sites/sitename``.
+        library_name: Display name of the document library (e.g. ``Documents``).
+
+    Returns:
+        A ``(site_id, drive_id)`` tuple.
+
+    Raises:
+        ValueError: When the site URL cannot be parsed.
+        RuntimeError: When the Graph API call fails.
+    """
+    parsed = urllib.parse.urlparse(site_url)
+    hostname = parsed.hostname
+    site_path = parsed.path.rstrip("/")
+
+    if not hostname or not site_path:
+        raise ValueError(
+            f"Invalid SharePoint site URL '{site_url}'. Expected format: https://tenant.sharepoint.com/sites/sitename"
+        )
+
+    headers = {"Authorization": f"Bearer {access_token}"}
+
+    # Resolve site ID
+    site_api_url = f"https://graph.microsoft.com/v1.0/sites/{hostname}:{site_path}"
+    logger.info("Resolving SharePoint site: %s", site_api_url)
+    resp = requests.get(site_api_url, headers=headers, timeout=settings.http_request_timeout)
+
+    if resp.status_code != 200:
+        raise RuntimeError(f"Failed to resolve SharePoint site: {resp.status_code} - {resp.text}")
+
+    site_id = resp.json()["id"]
+    logger.info("Resolved SharePoint site ID: %s", site_id)
+
+    # Resolve drive ID from the document library name
+    drives_url = f"https://graph.microsoft.com/v1.0/sites/{site_id}/drives"
+    resp = requests.get(drives_url, headers=headers, timeout=settings.http_request_timeout)
+
+    if resp.status_code != 200:
+        raise RuntimeError(f"Failed to list SharePoint drives: {resp.status_code} - {resp.text}")
+
+    drives = resp.json().get("value", [])
+    drive_id = None
+    for drive in drives:
+        if drive.get("name", "").lower() == library_name.lower():
+            drive_id = drive["id"]
+            break
+
+    if not drive_id:
+        available = [d.get("name") for d in drives]
+        raise RuntimeError(f"Document library '{library_name}' not found on site. Available libraries: {available}")
+
+    logger.info("Resolved SharePoint drive ID: %s (library: %s)", drive_id, library_name)
+    return site_id, drive_id
+
+
+def create_sharepoint_upload_session(
+    filename: str, folder_path: str | None, drive_id: str, site_id: str, access_token: str
+) -> str:
+    """Create a resumable upload session on a SharePoint document library.
+
+    Args:
+        filename: Name of the file to upload.
+        folder_path: Optional subfolder path inside the library.
+        drive_id: Graph API drive ID of the document library.
+        site_id: Graph API site ID.
+        access_token: Valid access token.
+
+    Returns:
+        The upload session URL for chunked PUT requests.
+
+    Raises:
+        RuntimeError: When session creation fails.
+    """
+    base_url = f"https://graph.microsoft.com/v1.0/sites/{site_id}/drives/{drive_id}"
+
+    if folder_path:
+        folder_path = folder_path.strip("/")
+        path_components = folder_path.split("/")
+        encoded_path = "/".join(urllib.parse.quote(component) for component in path_components)
+        encoded_filename = urllib.parse.quote(filename)
+        item_path = f"/root:/{encoded_path}/{encoded_filename}:/createUploadSession"
+    else:
+        encoded_filename = urllib.parse.quote(filename)
+        item_path = f"/root:/{encoded_filename}:/createUploadSession"
+
+    url = f"{base_url}{item_path}"
+    request_body = {"item": {"@microsoft.graph.conflictBehavior": "replace"}}
+    headers = {"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
+
+    logger.info("Creating SharePoint upload session for %s at path %s", filename, folder_path)
+    response = requests.post(url, headers=headers, json=request_body, timeout=settings.http_request_timeout)
+
+    if response.status_code == 200:
+        upload_url = response.json().get("uploadUrl")
+        logger.info("SharePoint upload session created for %s", filename)
+        return upload_url
+    else:
+        raise RuntimeError(f"Failed to create SharePoint upload session: {response.status_code} - {response.text}")
+
+
+def upload_large_file_sharepoint(file_path: str, upload_url: str) -> dict:
+    """Upload a file to SharePoint using a chunked upload session.
+
+    Args:
+        file_path: Local path to the file.
+        upload_url: The upload session URL from ``create_sharepoint_upload_session``.
+
+    Returns:
+        The Graph API response dict containing file metadata.
+
+    Raises:
+        RuntimeError: When a chunk upload fails after retries.
+    """
+    file_size = os.path.getsize(file_path)
+    chunk_size = 10 * 1024 * 1024  # 10 MB
+
+    response = None
+    with open(file_path, "rb") as f:
+        chunk_number = 0
+        while True:
+            chunk = f.read(chunk_size)
+            if not chunk:
+                break
+
+            chunk_start = chunk_number * chunk_size
+            chunk_end = chunk_start + len(chunk) - 1
+            content_range = f"bytes {chunk_start}-{chunk_end}/{file_size}"
+
+            headers = {"Content-Length": str(len(chunk)), "Content-Range": content_range}
+
+            max_retries = 3
+            retry_delay = 2
+
+            for attempt in range(max_retries):
+                try:
+                    response = requests.put(
+                        upload_url, headers=headers, data=chunk, timeout=settings.http_request_timeout
+                    )
+                    if response.status_code in (201, 202):
+                        break
+                    else:
+                        logger.warning(
+                            "SharePoint chunk upload failed (attempt %d): %d", attempt + 1, response.status_code
+                        )
+                        if attempt < max_retries - 1:
+                            time.sleep(retry_delay * (attempt + 1))
+                except Exception as e:
+                    logger.warning("SharePoint chunk upload error (attempt %d): %s", attempt + 1, str(e))
+                    if attempt < max_retries - 1:
+                        time.sleep(retry_delay * (attempt + 1))
+
+            if response is None or response.status_code not in (201, 202):
+                status = response.status_code if response else "no response"
+                text = response.text if response else ""
+                raise RuntimeError(f"Failed to upload chunk after {max_retries} attempts: {status} - {text}")
+
+            chunk_number += 1
+
+    return response.json() if response else {}
+
+
+@celery.task(base=UploadTaskWithRetry, bind=True)
+def upload_to_sharepoint(self, file_path: str, file_id: int = None, folder_override: str = None):
+    """Upload a file to SharePoint Online.
+
+    Args:
+        file_path: Path to the file to upload.
+        file_id: Optional file ID to associate with logs.
+        folder_override: Optional folder path override.
+
+    Returns:
+        A dict with upload status and file details.
+
+    Raises:
+        FileNotFoundError: When the file does not exist.
+        ValueError: When SharePoint is not configured.
+        RuntimeError: When the upload fails.
+    """
+    task_id = self.request.id
+    logger.info("[%s] Starting SharePoint upload: %s", task_id, file_path)
+    log_task_progress(
+        task_id,
+        "upload_to_sharepoint",
+        "in_progress",
+        f"Uploading to SharePoint: {os.path.basename(file_path)}",
+        file_id=file_id,
+    )
+
+    if not os.path.exists(file_path):
+        error_msg = f"File not found: {file_path}"
+        logger.error("[%s] %s", task_id, error_msg)
+        log_task_progress(task_id, "upload_to_sharepoint", "failure", error_msg, file_id=file_id)
+        raise FileNotFoundError(error_msg)
+
+    filename = os.path.basename(file_path)
+
+    if not settings.sharepoint_client_id:
+        error_msg = "SharePoint client ID is not configured"
+        logger.error("[%s] %s", task_id, error_msg)
+        log_task_progress(task_id, "upload_to_sharepoint", "failure", error_msg, file_id=file_id)
+        raise ValueError(error_msg)
+
+    if not settings.sharepoint_site_url:
+        error_msg = "SharePoint site URL is not configured"
+        logger.error("[%s] %s", task_id, error_msg)
+        log_task_progress(task_id, "upload_to_sharepoint", "failure", error_msg, file_id=file_id)
+        raise ValueError(error_msg)
+
+    try:
+        access_token = get_sharepoint_token()
+
+        library_name = settings.sharepoint_document_library or "Documents"
+        site_id, drive_id = resolve_sharepoint_drive(access_token, settings.sharepoint_site_url, library_name)
+
+        folder_path = folder_override if folder_override is not None else settings.sharepoint_folder_path
+
+        upload_url = create_sharepoint_upload_session(filename, folder_path, drive_id, site_id, access_token)
+        result = upload_large_file_sharepoint(file_path, upload_url)
+
+        web_url = result.get("webUrl", "Not available")
+        logger.info("[%s] Successfully uploaded %s to SharePoint", task_id, filename)
+        logger.info("[%s] File accessible at: %s", task_id, web_url)
+        log_task_progress(
+            task_id, "upload_to_sharepoint", "success", f"Uploaded to SharePoint: {filename}", file_id=file_id
+        )
+
+        return {
+            "status": "Completed",
+            "file_path": file_path,
+            "sharepoint_path": f"{folder_path or ''}/{filename}",
+            "web_url": web_url,
+        }
+
+    except Exception as e:
+        error_msg = f"Failed to upload {filename} to SharePoint: {str(e)}"
+        logger.error("[%s] %s", task_id, error_msg)
+        log_task_progress(task_id, "upload_to_sharepoint", "failure", error_msg, file_id=file_id)
+        raise RuntimeError(error_msg) from e

app/tasks/upload_to_user_integration.py

@@ -571,6 +571,113 @@ def _upload_rclone(file_path: str, cfg: dict[str, Any], creds: dict[str, Any], t
     return {"status": "Completed", "rclone_dest": dest}
 
 
+def _upload_sharepoint(file_path: str, cfg: dict[str, Any], creds: dict[str, Any], task_id: str) -> dict[str, Any]:
+    """Upload *file_path* to SharePoint using per-user MSAL credentials."""
+    import urllib.parse
+
+    import msal
+    import requests as _requests
+
+    client_id = creds.get("client_id") or ""
+    client_secret = creds.get("client_secret") or ""
+    refresh_token = creds.get("refresh_token") or ""
+    tenant = cfg.get("tenant_id") or "common"
+    site_url = cfg.get("site_url") or ""
+    library_name = cfg.get("document_library") or "Documents"
+    folder_path = cfg.get("folder_path") or ""
+
+    if not (client_id and client_secret):
+        raise ValueError("SharePoint integration is missing client_id or client_secret in credentials")
+    if not site_url:
+        raise ValueError("SharePoint integration is missing site_url in config")
+
+    scopes = ["https://graph.microsoft.com/.default"]
+    msal_app = msal.ConfidentialClientApplication(
+        client_id=client_id,
+        client_credential=client_secret,
+        authority=f"https://login.microsoftonline.com/{tenant}",
+    )
+
+    if refresh_token:
+        token_resp = msal_app.acquire_token_by_refresh_token(refresh_token=refresh_token, scopes=scopes)
+    else:
+        token_resp = msal_app.acquire_token_for_client(scopes=scopes)
+
+    if "access_token" not in token_resp:
+        raise ValueError(f"SharePoint token acquisition failed: {token_resp.get('error_description', 'unknown')}")
+
+    access_token = token_resp["access_token"]
+    headers = {"Authorization": f"Bearer {access_token}"}
+
+    # Resolve site ID
+    parsed = urllib.parse.urlparse(site_url)
+    hostname = parsed.hostname
+    site_path = parsed.path.rstrip("/")
+    if not hostname or not site_path:
+        raise ValueError(f"Invalid SharePoint site URL: {site_url}")
+
+    resp = _requests.get(f"https://graph.microsoft.com/v1.0/sites/{hostname}:{site_path}", headers=headers, timeout=30)
+    resp.raise_for_status()
+    site_id = resp.json()["id"]
+
+    # Resolve drive ID
+    resp = _requests.get(f"https://graph.microsoft.com/v1.0/sites/{site_id}/drives", headers=headers, timeout=30)
+    resp.raise_for_status()
+    drive_id = None
+    for drive in resp.json().get("value", []):
+        if drive.get("name", "").lower() == library_name.lower():
+            drive_id = drive["id"]
+            break
+    if not drive_id:
+        raise RuntimeError(f"Document library '{library_name}' not found on SharePoint site")
+
+    filename = os.path.basename(file_path)
+
+    # Build upload-session URL
+    base_url = f"https://graph.microsoft.com/v1.0/sites/{site_id}/drives/{drive_id}"
+    if folder_path:
+        folder_path = folder_path.strip("/")
+        encoded_path = "/".join(urllib.parse.quote(p) for p in folder_path.split("/"))
+        encoded_file = urllib.parse.quote(filename)
+        item_path = f"/root:/{encoded_path}/{encoded_file}:/createUploadSession"
+    else:
+        encoded_file = urllib.parse.quote(filename)
+        item_path = f"/root:/{encoded_file}:/createUploadSession"
+
+    session_url = f"{base_url}{item_path}"
+    session_headers = {"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
+    resp = _requests.post(
+        session_url,
+        headers=session_headers,
+        json={"item": {"@microsoft.graph.conflictBehavior": "replace"}},
+        timeout=30,
+    )
+    resp.raise_for_status()
+    upload_url = resp.json()["uploadUrl"]
+
+    file_size = os.path.getsize(file_path)
+    chunk_size = 10 * 1024 * 1024
+    with open(file_path, "rb") as fh:
+        chunk_num = 0
+        while True:
+            chunk = fh.read(chunk_size)
+            if not chunk:
+                break
+            start = chunk_num * chunk_size
+            end = start + len(chunk) - 1
+            upload_headers = {
+                "Content-Length": str(len(chunk)),
+                "Content-Range": f"bytes {start}-{end}/{file_size}",
+            }
+            upload_resp = _requests.put(upload_url, headers=upload_headers, data=chunk, timeout=120)
+            if upload_resp.status_code not in (201, 202):
+                raise RuntimeError(f"SharePoint chunk upload failed: {upload_resp.status_code}")
+            chunk_num += 1
+
+    logger.info("[%s] SharePoint upload complete: %s/%s", task_id, folder_path, filename)
+    return {"status": "Completed", "sharepoint_folder": folder_path, "filename": filename}
+
+
 def _upload_icloud(file_path: str, cfg: dict[str, Any], creds: dict[str, Any], task_id: str) -> dict[str, Any]:
     """Upload *file_path* to iCloud Drive using per-user credentials.
 
@@ -615,6 +722,7 @@ _UPLOAD_HANDLERS = {
     IntegrationType.PAPERLESS: _upload_paperless,
     IntegrationType.EMAIL: _upload_email,
     IntegrationType.RCLONE: _upload_rclone,
+    IntegrationType.SHAREPOINT: _upload_sharepoint,
     IntegrationType.ICLOUD: _upload_icloud,
 }
 

app/tasks/upload_with_rclone.py

@@ -55,12 +55,12 @@ def upload_with_rclone(self, file_path: str, destination: str):
 
     try:
         # Ensure the remote path exists (create folders if needed)
-        mkdir_cmd = ["rclone", "mkdir", "--config", rclone_config_path, destination]
+        mkdir_cmd = ["rclone", "mkdir", "--config", rclone_config_path, "--", destination]
 
         subprocess.run(mkdir_cmd, check=True, capture_output=True)  # noqa: S603
 
         # Construct the upload command
-        upload_cmd = ["rclone", "copy", "--config", rclone_config_path, file_path, destination, "--progress"]
+        upload_cmd = ["rclone", "copy", "--config", rclone_config_path, "--progress", "--", file_path, destination]
 
         log_task_progress(task_id, "rclone_upload", "in_progress", f"Executing rclone copy to {destination}")
 
@@ -71,7 +71,7 @@ def upload_with_rclone(self, file_path: str, destination: str):
         if result.returncode == 0:
             # Try to get a public link if possible
             try:
-                link_cmd = ["rclone", "link", "--config", rclone_config_path, f"{destination}/{filename}"]
+                link_cmd = ["rclone", "link", "--config", rclone_config_path, "--", f"{destination}/{filename}"]
                 link_result = subprocess.run(link_cmd, capture_output=True, text=True, check=False)  # noqa: S603
                 public_url = link_result.stdout.strip() if link_result.returncode == 0 else None
             except (subprocess.SubprocessError, OSError) as e:

app/utils/config_validator/providers.py

@@ -296,6 +296,28 @@ def get_provider_status() -> dict[str, dict[str, object]]:
         },
     }
 
+    # Check SharePoint configuration
+    providers["SharePoint"] = {
+        "name": "SharePoint",
+        "icon": "fa-brands fa-microsoft",
+        "configured": bool(
+            getattr(settings, "sharepoint_client_id", None)
+            and getattr(settings, "sharepoint_client_secret", None)
+            and getattr(settings, "sharepoint_site_url", None)
+        ),
+        "enabled": True,
+        "description": "Store documents in Microsoft SharePoint Online",
+        "details": {
+            "client_id": getattr(settings, "sharepoint_client_id", "Not set"),
+            "client_secret": mask_sensitive_value(getattr(settings, "sharepoint_client_secret", None)),
+            "tenant_id": getattr(settings, "sharepoint_tenant_id", "Not set"),
+            "refresh_token": mask_sensitive_value(getattr(settings, "sharepoint_refresh_token", None)),
+            "site_url": getattr(settings, "sharepoint_site_url", "Not set"),
+            "document_library": getattr(settings, "sharepoint_document_library", "Not set"),
+            "folder_path": getattr(settings, "sharepoint_folder_path", "Not set"),
+        },
+    }
+
     # Check S3 configuration
     providers["S3 Storage"] = {
         "name": "S3 Storage",

app/utils/db_migrate.py

@@ -12,9 +12,10 @@ The utility:
 """
 
 import logging
+import re
 from typing import Any
 
-from sqlalchemy import MetaData, create_engine, inspect, text
+from sqlalchemy import MetaData, create_engine, func, inspect, select, table
 from sqlalchemy.engine import Engine
 from sqlalchemy.engine.url import make_url
 from sqlalchemy.orm import sessionmaker
@@ -84,8 +85,13 @@ def preview_migration(source_url: str) -> dict[str, Any]:
         total = 0
         with src_engine.connect() as conn:
             for table_name in tables:
+                if not re.match(r"^[a-zA-Z0-9_]+$", table_name):
+                    logger.warning(f"Skipping table with invalid name format: {table_name}")
+                    continue
                 # table_name is safe — sourced from inspect().get_table_names(), not user input
-                row = conn.execute(text(f'SELECT COUNT(*) FROM "{table_name}"')).fetchone()  # noqa: S608
+                t = table(table_name)
+                query = select(func.count()).select_from(t)
+                row = conn.execute(query).fetchone()
                 count = row[0] if row else 0
                 result.append({"name": table_name, "row_count": count})
                 total += count

app/utils/env_utils.py

@@ -0,0 +1,54 @@
+import logging
+import os
+
+logger = logging.getLogger(__name__)
+
+
+def update_env_file(settings_to_update: dict[str, str]) -> bool:
+    """
+    Updates the .env file with the given settings (best-effort).
+    Creates or modifies existing keys.
+
+    Args:
+        settings_to_update: A dictionary mapping uppercase env var names to their new string values.
+
+    Returns:
+        True if the file was successfully updated, False otherwise.
+    """
+    try:
+        env_path = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), ".env")
+        if not os.path.exists(env_path):
+            logger.warning(f".env file not found at {env_path}, skipping file write")
+            return False
+
+        logger.info(f"Updating settings in {env_path}")
+
+        with open(env_path, "r") as f:
+            env_lines = f.readlines()
+
+        updated = set()
+        new_env_lines = []
+        for line in env_lines:
+            stripped_line = line.rstrip()
+            is_updated = False
+            for key, value in settings_to_update.items():
+                if stripped_line.startswith(f"{key}=") or stripped_line.startswith(f"# {key}="):
+                    new_env_lines.append(f"{key}={value}")
+                    updated.add(key)
+                    is_updated = True
+                    break
+            if not is_updated:
+                new_env_lines.append(stripped_line)
+
+        for key, value in settings_to_update.items():
+            if key not in updated:
+                new_env_lines.append(f"{key}={value}")
+
+        with open(env_path, "w") as f:
+            f.write("\n".join(new_env_lines) + "\n")
+
+        logger.info("Successfully updated settings in .env file")
+        return True
+    except Exception as env_err:
+        logger.warning(f"Failed to write .env file (non-fatal): {env_err}")
+        return False

app/utils/file_operations.py

@@ -7,8 +7,19 @@ def hash_file(filepath: str | Path, chunk_size: int = 65536) -> str:
     Returns the SHA-256 hash of the file at 'filepath'.
     Reads the file in chunks to handle large files efficiently.
     """
+    from app.config import settings
+
+    filepath_obj = Path(filepath).resolve()
+    workdir_obj = Path(settings.workdir).resolve()
+
+    # Security check: Ensure the resolved path is strictly within the allowed workdir
+    try:
+        filepath_obj.relative_to(workdir_obj)
+    except ValueError:
+        raise FileNotFoundError(f"Access denied: path traversal attempt or file outside workdir '{filepath}'")
+
     sha256 = hashlib.sha256()
-    with open(filepath, "rb") as f:
+    with open(filepath_obj, "rb") as f:
         while True:
             data = f.read(chunk_size)
             if not data:

app/utils/i18n.py

@@ -2,7 +2,7 @@
 
 Provides a JSON-based translation system for the DocuElevate UI with:
 
-* **49 supported languages** covering European, Asian, Middle-Eastern, and other languages
+* **77 supported languages** covering European, Asian, Middle-Eastern, African, and other languages
 * Browser ``Accept-Language`` detection with cookie & user-profile persistence
 * AI-powered fallback translation via the configured LLM provider
 * Locale-aware date, number, and file-size formatting helpers
@@ -34,65 +34,102 @@ logger = logging.getLogger(__name__)
 
 SUPPORTED_LANGUAGES: list[dict[str, str]] = [
     # --- Tier 1: Primary European languages ---
-    {"code": "en", "name": "English", "native": "English", "flag": "🇬🇧"},
-    {"code": "de", "name": "German", "native": "Deutsch", "flag": "🇩🇪"},
-    {"code": "fr", "name": "French", "native": "Français", "flag": "🇫🇷"},
-    {"code": "es", "name": "Spanish", "native": "Español", "flag": "🇪🇸"},
-    {"code": "it", "name": "Italian", "native": "Italiano", "flag": "🇮🇹"},
-    {"code": "pt", "name": "Portuguese", "native": "Português", "flag": "🇵🇹"},
+    # flag: lowercase ISO 3166-1 alpha-2 country code used with the flag-icons CSS library
+    # (e.g. "gb" → <span class="fi fi-gb">). Regional codes like "gb-wls" are also supported.
+    {"code": "en", "name": "English", "native": "English", "flag": "gb"},
+    {"code": "de", "name": "German", "native": "Deutsch", "flag": "de"},
+    {"code": "fr", "name": "French", "native": "Français", "flag": "fr"},
+    {"code": "es", "name": "Spanish", "native": "Español", "flag": "es"},
+    {"code": "it", "name": "Italian", "native": "Italiano", "flag": "it"},
+    {"code": "pt", "name": "Portuguese", "native": "Português", "flag": "pt"},
     # --- Tier 2: Western & Northern European ---
-    {"code": "nl", "name": "Dutch", "native": "Nederlands", "flag": "🇳🇱"},
-    {"code": "nb", "name": "Norwegian Bokmål", "native": "Norsk bokmål", "flag": "🇳🇴"},
-    {"code": "no", "name": "Norwegian", "native": "Norsk", "flag": "🇳🇴"},
-    {"code": "da", "name": "Danish", "native": "Dansk", "flag": "🇩🇰"},
-    {"code": "sv", "name": "Swedish", "native": "Svenska", "flag": "🇸🇪"},
-    {"code": "fi", "name": "Finnish", "native": "Suomi", "flag": "🇫🇮"},
-    {"code": "is", "name": "Icelandic", "native": "Íslenska", "flag": "🇮🇸"},
-    {"code": "ga", "name": "Irish", "native": "Gaeilge", "flag": "🇮🇪"},
-    {"code": "lb", "name": "Luxembourgish", "native": "Lëtzebuergesch", "flag": "🇱🇺"},
-    {"code": "ca", "name": "Catalan", "native": "Català", "flag": "🏴"},
-    {"code": "cy", "name": "Welsh", "native": "Cymraeg", "flag": "🏴󠁧󠁢󠁷󠁬󠁳󠁿"},  # Wales subdivision flag (U+1F3F4 + tag chars)
-    {"code": "fy", "name": "Frisian", "native": "Frysk", "flag": "🇳🇱"},
-    {"code": "gl", "name": "Galician", "native": "Galego", "flag": "🇪🇸"},
-    {"code": "li", "name": "Limburgish", "native": "Limburgs", "flag": "🇳🇱"},
-    {"code": "vls", "name": "West Flemish", "native": "West-Vlams", "flag": "🇧🇪"},
-    {"code": "nds", "name": "Low German", "native": "Plattdüütsch", "flag": "🇩🇪"},
+    {"code": "nl", "name": "Dutch", "native": "Nederlands", "flag": "nl"},
+    {"code": "nb", "name": "Norwegian Bokmål", "native": "Norsk bokmål", "flag": "no"},
+    {"code": "no", "name": "Norwegian", "native": "Norsk", "flag": "no"},
+    {"code": "da", "name": "Danish", "native": "Dansk", "flag": "dk"},
+    {"code": "sv", "name": "Swedish", "native": "Svenska", "flag": "se"},
+    {"code": "fi", "name": "Finnish", "native": "Suomi", "flag": "fi"},
+    {"code": "is", "name": "Icelandic", "native": "Íslenska", "flag": "is"},
+    {"code": "ga", "name": "Irish", "native": "Gaeilge", "flag": "ie"},
+    {"code": "lb", "name": "Luxembourgish", "native": "Lëtzebuergesch", "flag": "lu"},
+    {"code": "ca", "name": "Catalan", "native": "Català", "flag": "es"},  # no dedicated ISO flag; use Spain
+    {"code": "cy", "name": "Welsh", "native": "Cymraeg", "flag": "gb-wls"},  # flag-icons GB region code
+    {"code": "fy", "name": "Western Frisian", "native": "Frysk", "flag": "nl"},
+    {"code": "gl", "name": "Galician", "native": "Galego", "flag": "es"},
+    {"code": "li", "name": "Limburgish", "native": "Limburgs", "flag": "nl"},
+    {"code": "vls", "name": "Flemish", "native": "West-Vlams", "flag": "be"},
+    {"code": "nds", "name": "Low German", "native": "Plattdüütsch", "flag": "de"},
     # --- Tier 3: Central & Eastern European ---
-    {"code": "pl", "name": "Polish", "native": "Polski", "flag": "🇵🇱"},
-    {"code": "cs", "name": "Czech", "native": "Čeština", "flag": "🇨🇿"},
-    {"code": "sk", "name": "Slovak", "native": "Slovenčina", "flag": "🇸🇰"},
-    {"code": "hu", "name": "Hungarian", "native": "Magyar", "flag": "🇭🇺"},
-    {"code": "sl", "name": "Slovenian", "native": "Slovenščina", "flag": "🇸🇮"},
-    {"code": "hr", "name": "Croatian", "native": "Hrvatski", "flag": "🇭🇷"},
-    {"code": "ro", "name": "Romanian", "native": "Română", "flag": "🇷🇴"},
-    {"code": "bg", "name": "Bulgarian", "native": "Български", "flag": "🇧🇬"},
-    {"code": "el", "name": "Greek", "native": "Ελληνικά", "flag": "🇬🇷"},
-    {"code": "et", "name": "Estonian", "native": "Eesti", "flag": "🇪🇪"},
-    {"code": "lv", "name": "Latvian", "native": "Latviešu", "flag": "🇱🇻"},
-    {"code": "lt", "name": "Lithuanian", "native": "Lietuvių", "flag": "🇱🇹"},
-    {"code": "sr", "name": "Serbian", "native": "Српски", "flag": "🇷🇸"},
+    {"code": "pl", "name": "Polish", "native": "Polski", "flag": "pl"},
+    {"code": "cs", "name": "Czech", "native": "Čeština", "flag": "cz"},
+    {"code": "sk", "name": "Slovak", "native": "Slovenčina", "flag": "sk"},
+    {"code": "hu", "name": "Hungarian", "native": "Magyar", "flag": "hu"},
+    {"code": "sl", "name": "Slovenian", "native": "Slovenščina", "flag": "si"},
+    {"code": "hr", "name": "Croatian", "native": "Hrvatski", "flag": "hr"},
+    {"code": "ro", "name": "Romanian", "native": "Română", "flag": "ro"},
+    {"code": "bg", "name": "Bulgarian", "native": "Български", "flag": "bg"},
+    {"code": "el", "name": "Greek", "native": "Ελληνικά", "flag": "gr"},
+    {"code": "et", "name": "Estonian", "native": "Eesti", "flag": "ee"},
+    {"code": "lv", "name": "Latvian", "native": "Latviešu", "flag": "lv"},
+    {"code": "lt", "name": "Lithuanian", "native": "Lietuvių", "flag": "lt"},
+    {"code": "sr", "name": "Serbian", "native": "Српски", "flag": "rs"},
     # --- Tier 4: Non-EU European, Middle Eastern & African ---
-    {"code": "tr", "name": "Turkish", "native": "Türkçe", "flag": "🇹🇷"},
-    {"code": "uk", "name": "Ukrainian", "native": "Українська", "flag": "🇺🇦"},
-    {"code": "ru", "name": "Russian", "native": "Русский", "flag": "🇷🇺"},
-    {"code": "he", "name": "Hebrew", "native": "עברית", "flag": "🇮🇱"},
-    {"code": "ar", "name": "Arabic", "native": "العربية", "flag": "🇸🇦"},
-    {"code": "fa", "name": "Persian", "native": "فارسی", "flag": "🇮🇷"},
-    {"code": "af", "name": "Afrikaans", "native": "Afrikaans", "flag": "🇿🇦"},
+    {"code": "tr", "name": "Turkish", "native": "Türkçe", "flag": "tr"},
+    {"code": "uk", "name": "Ukrainian", "native": "Українська", "flag": "ua"},
+    {"code": "he", "name": "Hebrew", "native": "עברית", "flag": "il"},
+    {"code": "ar", "name": "Arabic", "native": "العربية", "flag": "sa"},
+    {"code": "fa", "name": "Persian", "native": "فارسی", "flag": "ir"},
+    {"code": "af", "name": "Afrikaans", "native": "Afrikaans", "flag": "za"},
     # --- Tier 5: Asian languages ---
-    {"code": "zh", "name": "Chinese", "native": "中文", "flag": "🇨🇳"},
-    {"code": "ja", "name": "Japanese", "native": "日本語", "flag": "🇯🇵"},
-    {"code": "ko", "name": "Korean", "native": "한국어", "flag": "🇰🇷"},
-    {"code": "vi", "name": "Vietnamese", "native": "Tiếng Việt", "flag": "🇻🇳"},
-    {"code": "pa", "name": "Punjabi", "native": "ਪੰਜਾਬੀ", "flag": "🇮🇳"},
-    {"code": "kn", "name": "Kannada", "native": "ಕನ್ನಡ", "flag": "🇮🇳"},
-    # --- Tier 6: Constructed & other languages ---
-    {"code": "eo", "name": "Esperanto", "native": "Esperanto", "flag": "🌍"},
+    {"code": "zh", "name": "Chinese", "native": "中文", "flag": "cn"},
+    {"code": "zh-TW", "name": "Traditional Chinese", "native": "繁體中文", "flag": "tw"},
+    {"code": "ja", "name": "Japanese", "native": "日本語", "flag": "jp"},
+    {"code": "ko", "name": "Korean", "native": "한국어", "flag": "kr"},
+    {"code": "vi", "name": "Vietnamese", "native": "Tiếng Việt", "flag": "vn"},
+    {"code": "pa", "name": "Punjabi", "native": "ਪੰਜਾਬੀ", "flag": "in"},
+    {"code": "kn", "name": "Kannada", "native": "ಕನ್ನಡ", "flag": "in"},
+    {"code": "hi", "name": "Hindi", "native": "हिन्दी", "flag": "in"},
+    {"code": "bn", "name": "Bengali", "native": "বাংলা", "flag": "bd"},
+    {"code": "gu", "name": "Gujarati", "native": "ગુજરાતી", "flag": "in"},
+    {"code": "ml", "name": "Malayalam", "native": "മലയാളം", "flag": "in"},
+    {"code": "mr", "name": "Marathi", "native": "मराठी", "flag": "in"},
+    {"code": "ta", "name": "Tamil", "native": "தமிழ்", "flag": "in"},
+    {"code": "te", "name": "Telugu", "native": "తెలుగు", "flag": "in"},
+    {"code": "ur", "name": "Urdu", "native": "اردو", "flag": "pk"},
+    {"code": "si", "name": "Sinhala", "native": "සිංහල", "flag": "lk"},
+    {"code": "ne", "name": "Nepali", "native": "नेपाली", "flag": "np"},
+    {"code": "th", "name": "Thai", "native": "ไทย", "flag": "th"},
+    {"code": "km", "name": "Khmer", "native": "ខ្មែរ", "flag": "kh"},
+    {"code": "id", "name": "Indonesian", "native": "Bahasa Indonesia", "flag": "id"},
+    {"code": "ms", "name": "Malay", "native": "Bahasa Melayu", "flag": "my"},
+    {"code": "jv", "name": "Javanese", "native": "Basa Jawa", "flag": "id"},
+    {"code": "tl", "name": "Tagalog", "native": "Filipino", "flag": "ph"},
+    {"code": "mn", "name": "Mongolian", "native": "Монгол", "flag": "mn"},
+    {"code": "kk", "name": "Kazakh", "native": "Қазақ тілі", "flag": "kz"},
+    {"code": "uz", "name": "Uzbek", "native": "Oʻzbekcha", "flag": "uz"},
+    {"code": "az", "name": "Azerbaijani", "native": "Azərbaycan dili", "flag": "az"},
+    {"code": "hy", "name": "Armenian", "native": "Հայերեն", "flag": "am"},
+    {"code": "ka", "name": "Georgian", "native": "ქართული", "flag": "ge"},
+    # --- Tier 6: African languages ---
+    {"code": "sw", "name": "Swahili", "native": "Kiswahili", "flag": "ke"},
+    {"code": "am", "name": "Amharic", "native": "አማርኛ", "flag": "et"},
+    {"code": "ha", "name": "Hausa", "native": "Hausa", "flag": "ng"},
+    {"code": "yo", "name": "Yoruba", "native": "Yorùbá", "flag": "ng"},
+    {"code": "ig", "name": "Igbo", "native": "Igbo", "flag": "ng"},
+    {"code": "zu", "name": "Zulu", "native": "isiZulu", "flag": "za"},
+    # --- Tier 7: Constructed & other languages ---
+    {"code": "eo", "name": "Esperanto", "native": "Esperanto", "flag": "un"},  # UN flag for international language
 ]
 
 SUPPORTED_LANGUAGE_CODES: set[str] = {lang["code"] for lang in SUPPORTED_LANGUAGES}
 DEFAULT_LANGUAGE = "en"
 
+# Lookup map for fast code → language-dict resolution
+_LANG_CODE_MAP: dict[str, dict[str, str]] = {lang["code"]: lang for lang in SUPPORTED_LANGUAGES}
+
+# Global-usage order used to fill remaining slots in the smart suggestions list
+_POPULAR_LANGUAGE_CODES: list[str] = ["en", "zh", "es", "ar", "fr", "de", "ja", "pt", "hi", "ko"]
+
 # ---------------------------------------------------------------------------
 # Translation file loading
 # ---------------------------------------------------------------------------
@@ -263,14 +300,10 @@ def detect_language(request: Request) -> str:
     return DEFAULT_LANGUAGE
 
 
-def _parse_accept_language(header: str) -> str | None:
-    """Extract the best matching language from an ``Accept-Language`` header.
-
-    Parses quality values and returns the highest-priority match among
-    :data:`SUPPORTED_LANGUAGE_CODES`, or ``None`` if nothing matches.
-    """
+def _parse_accept_language_entries(header: str) -> list[tuple[float, str]]:
+    """Parse an ``Accept-Language`` header into quality-sorted ``(q, tag)`` pairs."""
     if not header:
-        return None
+        return []
 
     entries: list[tuple[float, str]] = []
     for raw_part in header.split(","):
@@ -288,11 +321,17 @@ def _parse_accept_language(header: str) -> str | None:
             quality = 1.0
         entries.append((quality, lang_tag.strip().lower()))
 
-    # Sort by quality descending
     entries.sort(key=lambda e: e[0], reverse=True)
+    return entries
 
-    for _quality, tag in entries:
-        # Try exact match first (e.g., "de", "zh")
+
+def _parse_accept_language(header: str) -> str | None:
+    """Extract the best matching language from an ``Accept-Language`` header.
+
+    Parses quality values and returns the highest-priority match among
+    :data:`SUPPORTED_LANGUAGE_CODES`, or ``None`` if nothing matches.
+    """
+    for _quality, tag in _parse_accept_language_entries(header):
         code = tag.split("-")[0]
         if code in SUPPORTED_LANGUAGE_CODES:
             return code
@@ -300,6 +339,45 @@ def _parse_accept_language(header: str) -> str | None:
     return None
 
 
+# Maximum number of languages shown in the compact nav-bar dropdown
+_SUGGESTED_LANGUAGES_MAX = 6
+
+
+def get_suggested_languages(current_locale: str, accept_language_header: str = "") -> list[dict[str, str]]:
+    """Return up to :data:`_SUGGESTED_LANGUAGES_MAX` suggested languages for the compact picker.
+
+    Selection priority:
+        1. The currently active language (always included first).
+        2. Languages listed in the browser's ``Accept-Language`` header.
+        3. Popular global languages (by estimated speaker count) as fillers.
+
+    The resulting list is de-duplicated and capped at
+    :data:`_SUGGESTED_LANGUAGES_MAX` entries.
+    """
+    candidates: list[str] = []
+
+    # 1. Active locale first
+    if current_locale in SUPPORTED_LANGUAGE_CODES:
+        candidates.append(current_locale)
+
+    # 2. Browser preferences
+    for _quality, tag in _parse_accept_language_entries(accept_language_header):
+        if len(candidates) >= _SUGGESTED_LANGUAGES_MAX:
+            break
+        code = tag.split("-")[0]
+        if code in SUPPORTED_LANGUAGE_CODES and code not in candidates:
+            candidates.append(code)
+
+    # 3. Popular language fillers
+    for code in _POPULAR_LANGUAGE_CODES:
+        if len(candidates) >= _SUGGESTED_LANGUAGES_MAX:
+            break
+        if code not in candidates and code in SUPPORTED_LANGUAGE_CODES:
+            candidates.append(code)
+
+    return [_LANG_CODE_MAP[c] for c in candidates[:_SUGGESTED_LANGUAGES_MAX] if c in _LANG_CODE_MAP]
+
+
 # ---------------------------------------------------------------------------
 # Localization helpers (l10n)
 # ---------------------------------------------------------------------------

app/utils/network.py

@@ -0,0 +1,60 @@
+import ipaddress
+import logging
+import socket
+from urllib.parse import urlsplit, urlunsplit
+
+logger = logging.getLogger(__name__)
+
+
+def is_private_ip(hostname: str) -> bool:
+    """
+    Check if a hostname resolves to a private/internal IP address.
+    Protects against SSRF attacks by blocking access to internal networks.
+    """
+    try:
+        # Try to parse as IP address directly
+        ip = ipaddress.ip_address(hostname)
+        return ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved
+    except ValueError:
+        # Not a direct IP, try to resolve hostname
+        try:
+            # Get all IP addresses for this hostname
+            addr_info = socket.getaddrinfo(hostname, None)
+            for info in addr_info:
+                ip_str = info[4][0]
+                ip = ipaddress.ip_address(ip_str)
+                # Block if ANY resolved IP is private/internal
+                if ip.is_private or ip.is_loopback or ip.is_link_local or ip.is_reserved:
+                    return True
+            return False
+        except (socket.gaierror, socket.error):
+            # Cannot resolve.
+            # Fail securely: block unresolved domains to prevent DNS rebinding
+            # and SSRF bypasses via unresolvable addresses.
+            logger.warning(f"Could not resolve hostname (blocking securely): {hostname}")
+            return True
+
+
+def join_url(base: str, *parts: str) -> str:
+    """
+    Safely join a base URL with one or more path parts.
+
+    Uses urllib.parse to correctly handle scheme/netloc/query/fragment so that
+    only the path component is modified.  Leading and trailing slashes are
+    stripped from each part before joining, preventing double-slash sequences
+    at segment boundaries without touching the scheme separator or query string.
+
+    Examples:
+        join_url("https://example.com/dav/", "/remote/", "file.pdf")
+        -> "https://example.com/dav/remote/file.pdf"
+    """
+    parsed = urlsplit(base)
+    # Strip each part once and filter out empty segments; use walrus operator
+    # to avoid calling strip twice per iteration.
+    stripped_parts = [s for p in parts if (s := p.strip("/"))]
+    base_path = parsed.path.rstrip("/")
+    new_path = base_path + "/" + "/".join(stripped_parts) if stripped_parts else base_path
+    # Ensure path is non-empty so the reconstructed URL is valid.
+    if not new_path:
+        new_path = "/"
+    return urlunsplit((parsed.scheme, parsed.netloc, new_path, parsed.query, parsed.fragment))

app/utils/session_manager.py

@@ -0,0 +1,505 @@
+"""Server-side session management utilities.
+
+Provides helpers for creating, validating, and revoking user sessions.
+Sessions are tracked in the ``user_sessions`` table and referenced by a
+cryptographically random token stored in the browser cookie.  This enables
+the "log off everywhere" feature and per-session revocation.
+"""
+
+from __future__ import annotations
+
+import logging
+import secrets
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy.orm import Session
+
+from app.config import settings
+from app.models import ApiToken, QRLoginChallenge, UserSession
+
+logger = logging.getLogger(__name__)
+
+
+def _ensure_tz_aware(dt: datetime | None) -> datetime | None:
+    """Return *dt* with UTC tzinfo if it is naive, or unchanged if already aware.
+
+    SQLite does not persist timezone information, so datetimes read back from
+    the database are offset-naive.  This helper normalises them for safe
+    comparison with ``datetime.now(timezone.utc)``.
+    """
+    if dt is not None and dt.tzinfo is None:
+        return dt.replace(tzinfo=timezone.utc)
+    return dt
+
+
+def get_session_lifetime_days() -> int:
+    """Return the effective session lifetime in days.
+
+    If ``session_lifetime_custom_days`` is set it takes precedence over
+    ``session_lifetime_days``.
+    """
+    custom = getattr(settings, "session_lifetime_custom_days", None)
+    if custom is not None and isinstance(custom, int) and custom > 0:
+        return custom
+    return max(1, getattr(settings, "session_lifetime_days", 30))
+
+
+def get_session_max_age_seconds() -> int:
+    """Return the session max-age in seconds for the cookie."""
+    return get_session_lifetime_days() * 86400
+
+
+def create_session(
+    db: Session,
+    user_id: str,
+    ip_address: str | None = None,
+    user_agent: str | None = None,
+) -> UserSession:
+    """Create a new server-side session record.
+
+    Args:
+        db: Database session.
+        user_id: Stable owner identifier.
+        ip_address: Client IP address.
+        user_agent: Client User-Agent header.
+
+    Returns:
+        The newly created ``UserSession`` instance.
+    """
+    session_token = secrets.token_urlsafe(64)
+    now = datetime.now(timezone.utc)
+    lifetime_days = get_session_lifetime_days()
+    expires_at = now + timedelta(days=lifetime_days)
+
+    device_info = _parse_device_info(user_agent)
+
+    user_session = UserSession(
+        session_token=session_token,
+        user_id=user_id,
+        ip_address=ip_address,
+        user_agent=(user_agent or "")[:512],
+        device_info=device_info,
+        created_at=now,
+        last_active_at=now,
+        expires_at=expires_at,
+    )
+    try:
+        db.add(user_session)
+        db.commit()
+        db.refresh(user_session)
+    except Exception:
+        db.rollback()
+        logger.exception("Failed to create session for user_id=%s", user_id)
+        raise
+
+    logger.info(
+        "[SESSION] Created session id=%s user=%s device=%r expires=%s",
+        user_session.id,
+        user_id,
+        device_info,
+        expires_at.isoformat(),
+    )
+    return user_session
+
+
+def validate_session(db: Session, session_token: str) -> UserSession | None:
+    """Validate a session token and return the session if valid.
+
+    A session is valid when:
+    * It exists in the database.
+    * ``is_revoked`` is ``False``.
+    * ``expires_at`` is in the future.
+
+    Side-effect: updates ``last_active_at`` on valid sessions.
+
+    Returns:
+        The ``UserSession`` if valid, else ``None``.
+    """
+    if not session_token:
+        return None
+
+    now = datetime.now(timezone.utc)
+    user_session = db.query(UserSession).filter(UserSession.session_token == session_token).first()
+
+    if not user_session:
+        logger.debug("[SESSION] Token not found in database")
+        return None
+
+    if user_session.is_revoked:
+        logger.debug("[SESSION] Session id=%s is revoked", user_session.id)
+        return None
+
+    if user_session.expires_at:
+        expires = _ensure_tz_aware(user_session.expires_at)
+        if expires < now:
+            logger.debug("[SESSION] Session id=%s has expired", user_session.id)
+            return None
+
+    # Update last_active_at (throttled to avoid excessive writes)
+    last_active = _ensure_tz_aware(user_session.last_active_at)
+    if not last_active or (now - last_active).total_seconds() > 60:
+        try:
+            user_session.last_active_at = now
+            db.commit()
+        except Exception:
+            db.rollback()
+            logger.debug("[SESSION] Failed to update last_active_at for session id=%s", user_session.id)
+
+    return user_session
+
+
+def revoke_session(db: Session, session_id: int, user_id: str) -> bool:
+    """Revoke a single session by ID.
+
+    Args:
+        db: Database session.
+        session_id: The session record ID to revoke.
+        user_id: The owner — ensures a user can only revoke their own sessions.
+
+    Returns:
+        ``True`` if the session was found and revoked, ``False`` otherwise.
+    """
+    user_session = db.get(UserSession, session_id)
+    if not user_session or user_session.user_id != user_id:
+        return False
+
+    now = datetime.now(timezone.utc)
+    user_session.is_revoked = True
+    user_session.revoked_at = now
+    try:
+        db.commit()
+    except Exception:
+        db.rollback()
+        raise
+
+    logger.info("[SESSION] Revoked session id=%s user=%s", session_id, user_id)
+    return True
+
+
+def revoke_all_sessions(
+    db: Session,
+    user_id: str,
+    *,
+    except_session_id: int | None = None,
+    revoke_api_tokens: bool = True,
+) -> int:
+    """Revoke all active sessions for a user ("log off everywhere").
+
+    Args:
+        db: Database session.
+        user_id: The owner whose sessions should be revoked.
+        except_session_id: If provided, keep this session active (the
+            current browser session).
+        revoke_api_tokens: If ``True``, also revoke all active API tokens.
+
+    Returns:
+        Number of sessions revoked.
+    """
+    now = datetime.now(timezone.utc)
+    query = db.query(UserSession).filter(
+        UserSession.user_id == user_id,
+        UserSession.is_revoked.is_(False),
+    )
+    if except_session_id is not None:
+        query = query.filter(UserSession.id != except_session_id)
+
+    sessions = query.all()
+    count = 0
+    for s in sessions:
+        s.is_revoked = True
+        s.revoked_at = now
+        count += 1
+
+    if revoke_api_tokens:
+        tokens = (
+            db.query(ApiToken)
+            .filter(
+                ApiToken.owner_id == user_id,
+                ApiToken.is_active.is_(True),
+            )
+            .all()
+        )
+        for t in tokens:
+            t.is_active = False
+            t.revoked_at = now
+
+    try:
+        db.commit()
+    except Exception:
+        db.rollback()
+        raise
+
+    logger.info(
+        "[SESSION] Revoked all sessions for user=%s (count=%d, except_session_id=%s, tokens_revoked=%s)",
+        user_id,
+        count,
+        except_session_id,
+        revoke_api_tokens,
+    )
+    return count
+
+
+def list_user_sessions(db: Session, user_id: str) -> list[UserSession]:
+    """Return all non-revoked, non-expired sessions for a user.
+
+    Results are ordered by most recently active first.
+    """
+    now = datetime.now(timezone.utc)
+    sessions = (
+        db.query(UserSession)
+        .filter(
+            UserSession.user_id == user_id,
+            UserSession.is_revoked.is_(False),
+        )
+        .order_by(UserSession.last_active_at.desc())
+        .all()
+    )
+    # Filter expired sessions in Python to handle timezone-naive datetimes (SQLite)
+    result = []
+    for s in sessions:
+        expires = _ensure_tz_aware(s.expires_at)
+        if expires and expires > now:
+            result.append(s)
+    return result
+
+
+def cleanup_expired_sessions(db: Session) -> int:
+    """Delete sessions that expired more than 7 days ago.
+
+    Intended to be called periodically (e.g. via Celery beat) to keep the
+    table from growing unbounded.
+
+    Returns:
+        Number of rows deleted.
+    """
+    cutoff = datetime.now(timezone.utc) - timedelta(days=7)
+    count = db.query(UserSession).filter(UserSession.expires_at < cutoff).delete(synchronize_session=False)
+    try:
+        db.commit()
+    except Exception:
+        db.rollback()
+        raise
+    if count:
+        logger.info("[SESSION] Cleaned up %d expired sessions", count)
+    return count
+
+
+# ---------------------------------------------------------------------------
+# QR login helpers
+# ---------------------------------------------------------------------------
+
+
+def create_qr_challenge(db: Session, user_id: str, ip_address: str | None = None) -> QRLoginChallenge:
+    """Create a new QR login challenge.
+
+    Args:
+        db: Database session.
+        user_id: The authenticated web user creating the challenge.
+        ip_address: IP address of the web client.
+
+    Returns:
+        The newly created ``QRLoginChallenge``.
+    """
+    token = secrets.token_urlsafe(64)
+    ttl = getattr(settings, "qr_login_challenge_ttl_seconds", 120)
+    now = datetime.now(timezone.utc)
+    expires_at = now + timedelta(seconds=ttl)
+
+    challenge = QRLoginChallenge(
+        challenge_token=token,
+        user_id=user_id,
+        created_by_ip=ip_address,
+        created_at=now,
+        expires_at=expires_at,
+    )
+    try:
+        db.add(challenge)
+        db.commit()
+        db.refresh(challenge)
+    except Exception:
+        db.rollback()
+        logger.exception("Failed to create QR login challenge for user_id=%s", user_id)
+        raise
+
+    logger.info("[QR_AUTH] Challenge created: id=%s user=%s expires=%s", challenge.id, user_id, expires_at.isoformat())
+    return challenge
+
+
+def validate_qr_challenge(db: Session, challenge_token: str) -> QRLoginChallenge | None:
+    """Validate a QR challenge token without claiming it.
+
+    Returns the challenge if it exists, is not expired, not claimed,
+    and not cancelled.  Returns ``None`` otherwise.
+    """
+    if not challenge_token:
+        return None
+
+    now = datetime.now(timezone.utc)
+    challenge = db.query(QRLoginChallenge).filter(QRLoginChallenge.challenge_token == challenge_token).first()
+
+    if not challenge:
+        return None
+    if challenge.is_claimed or challenge.is_cancelled:
+        return None
+
+    expires = _ensure_tz_aware(challenge.expires_at)
+    if expires and expires < now:
+        return None
+
+    return challenge
+
+
+def claim_qr_challenge(
+    db: Session,
+    challenge_token: str,
+    device_name: str = "Mobile App",
+    ip_address: str | None = None,
+) -> dict | None:
+    """Claim a QR challenge and issue an API token.
+
+    This is the critical security path.  The challenge is validated,
+    marked as claimed atomically, and an API token is issued for the
+    user who created the challenge.
+
+    Args:
+        db: Database session.
+        challenge_token: The token from the QR code.
+        device_name: Name provided by the mobile app.
+        ip_address: IP address of the claiming mobile device.
+
+    Returns:
+        Dict with ``token`` (plaintext), ``token_id``, ``name``, ``owner_id``
+        and ``created_at`` on success, or ``None`` if the challenge is invalid.
+    """
+    from app.api.api_tokens import generate_api_token, hash_token
+
+    challenge = validate_qr_challenge(db, challenge_token)
+    if not challenge:
+        logger.warning("[QR_AUTH] Invalid or expired challenge token attempted")
+        return None
+
+    now = datetime.now(timezone.utc)
+
+    # Mark as claimed first to prevent race conditions
+    challenge.is_claimed = True
+    challenge.claimed_at = now
+    challenge.claimed_by_ip = ip_address
+    challenge.device_name = device_name
+
+    # Generate API token for the mobile app
+    token_name = f"Mobile App (QR) – {device_name}"
+    plaintext = generate_api_token()
+    token_hash_value = hash_token(plaintext)
+    prefix = plaintext[:12]
+
+    db_token = ApiToken(
+        owner_id=challenge.user_id,
+        name=token_name,
+        token_hash=token_hash_value,
+        token_prefix=prefix,
+    )
+
+    try:
+        db.add(db_token)
+        db.flush()
+        challenge.issued_token_id = db_token.id
+        db.commit()
+        db.refresh(db_token)
+    except Exception:
+        db.rollback()
+        logger.exception("[QR_AUTH] Failed to issue token for challenge id=%s", challenge.id)
+        raise
+
+    logger.info(
+        "[QR_AUTH] Challenge claimed: id=%s user=%s device=%r token_id=%s",
+        challenge.id,
+        challenge.user_id,
+        device_name,
+        db_token.id,
+    )
+
+    return {
+        "token": plaintext,
+        "token_id": db_token.id,
+        "name": token_name,
+        "owner_id": challenge.user_id,
+        "created_at": db_token.created_at,
+    }
+
+
+def get_challenge_status(db: Session, challenge_id: int, user_id: str) -> dict | None:
+    """Get the current status of a QR challenge (for polling from the web UI).
+
+    Returns:
+        Dict with ``status`` ("pending", "claimed", "expired", "cancelled")
+        and metadata, or ``None`` if the challenge doesn't belong to the user.
+    """
+    challenge = db.get(QRLoginChallenge, challenge_id)
+    if not challenge or challenge.user_id != user_id:
+        return None
+
+    now = datetime.now(timezone.utc)
+    expires = _ensure_tz_aware(challenge.expires_at)
+
+    if challenge.is_claimed:
+        status = "claimed"
+    elif challenge.is_cancelled:
+        status = "cancelled"
+    elif expires and expires < now:
+        status = "expired"
+    else:
+        status = "pending"
+
+    return {
+        "id": challenge.id,
+        "status": status,
+        "device_name": challenge.device_name,
+        "claimed_at": challenge.claimed_at,
+        "expires_at": challenge.expires_at,
+    }
+
+
+def _parse_device_info(user_agent: str | None) -> str | None:
+    """Extract a human-readable device description from User-Agent.
+
+    This is a lightweight parser — not a full UA library — that covers
+    the most common browsers and platforms.
+    """
+    if not user_agent:
+        return None
+
+    ua = user_agent.lower()
+
+    # Platform detection
+    platform = "Unknown"
+    if "iphone" in ua:
+        platform = "iPhone"
+    elif "ipad" in ua:
+        platform = "iPad"
+    elif "android" in ua:
+        platform = "Android"
+    elif "macintosh" in ua or "mac os" in ua:
+        platform = "macOS"
+    elif "windows" in ua:
+        platform = "Windows"
+    elif "linux" in ua:
+        platform = "Linux"
+    elif "cros" in ua:
+        platform = "ChromeOS"
+
+    # Browser detection
+    browser = "Unknown Browser"
+    if "edg/" in ua or "edge/" in ua:
+        browser = "Edge"
+    elif "opr/" in ua or "opera" in ua:
+        browser = "Opera"
+    elif "chrome/" in ua and "safari/" in ua:
+        browser = "Chrome"
+    elif "safari/" in ua and "chrome/" not in ua:
+        browser = "Safari"
+    elif "firefox/" in ua:
+        browser = "Firefox"
+    elif "docuelevate" in ua:
+        browser = "DocuElevate App"
+
+    return f"{browser} on {platform}"

app/utils/settings_service.py

@@ -8,6 +8,7 @@ This module provides functionality to:
 """
 
 import logging
+import os
 from typing import Any, Dict, List, Optional, Tuple
 
 from sqlalchemy.exc import SQLAlchemyError
@@ -134,6 +135,30 @@ SETTING_METADATA = {
         "required": True,  # Required when auth_enabled=True (validated in config.py)
         "restart_required": True,
     },
+    "session_lifetime_days": {
+        "category": "Authentication",
+        "description": "Session lifetime in days (default 30). Determines how long a user stays logged in.",
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "session_lifetime_custom_days": {
+        "category": "Authentication",
+        "description": "Override session_lifetime_days with a custom value. Takes precedence when set.",
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "qr_login_challenge_ttl_seconds": {
+        "category": "Authentication",
+        "description": "Time-to-live in seconds for QR login challenges (default 120).",
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
     "admin_username": {
         "category": "Authentication",
         "description": "Admin username for local authentication",
@@ -522,6 +547,19 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": False,
     },
+    # Document Translation
+    "default_document_language": {
+        "category": "AI Services",
+        "description": (
+            "ISO 639-1 language code for the default document translation target "
+            "(e.g. 'en', 'de', 'fr'). Documents whose detected language differs "
+            "are automatically translated into this language after processing."
+        ),
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
     # OCR Engine Configuration
     "ocr_providers": {
         "category": "OCR Engines",
@@ -862,6 +900,63 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": False,
     },
+    # Storage Providers - SharePoint
+    "sharepoint_client_id": {
+        "category": "Storage Providers",
+        "description": "SharePoint Azure AD application (client) ID",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "sharepoint_client_secret": {
+        "category": "Storage Providers",
+        "description": "SharePoint Azure AD client secret",
+        "type": "string",
+        "sensitive": True,
+        "required": False,
+        "restart_required": False,
+    },
+    "sharepoint_tenant_id": {
+        "category": "Storage Providers",
+        "description": "SharePoint Azure AD tenant ID (use 'common' for multi-tenant apps)",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "sharepoint_refresh_token": {
+        "category": "Storage Providers",
+        "description": "SharePoint OAuth refresh token",
+        "type": "string",
+        "sensitive": True,
+        "required": False,
+        "restart_required": False,
+    },
+    "sharepoint_site_url": {
+        "category": "Storage Providers",
+        "description": "SharePoint site URL (e.g. https://tenant.sharepoint.com/sites/sitename)",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "sharepoint_document_library": {
+        "category": "Storage Providers",
+        "description": "SharePoint document library name (default: 'Documents')",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "sharepoint_folder_path": {
+        "category": "Storage Providers",
+        "description": "Subfolder path inside the SharePoint document library",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
     # Storage Providers - WebDAV
     "webdav_enabled": {
         "category": "Storage Providers",
@@ -1887,6 +1982,28 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": False,
     },
+    "factory_reset_on_startup": {
+        "category": "Feature Flags",
+        "description": (
+            "Wipe all user data on every startup so the instance always starts fresh. "
+            "Useful for demo/testing environments. Default: False."
+        ),
+        "type": "boolean",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "enable_factory_reset": {
+        "category": "Feature Flags",
+        "description": (
+            "Show the System Reset page in the admin UI.  Allows administrators to "
+            "trigger a full data wipe or a wipe-and-reimport from the web interface. Default: False."
+        ),
+        "type": "boolean",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
     # Backup / Restore
     "backup_enabled": {
         "category": "Backup",
@@ -1910,14 +2027,26 @@ SETTING_METADATA = {
         "category": "Backup",
         "description": (
             "Storage provider for remote backup copies. "
-            "Accepted values: s3, dropbox, google_drive, onedrive, nextcloud, webdav, ftp, sftp, email. "
+            "Accepted values: s3, dropbox, google_drive, onedrive, sharepoint, nextcloud, webdav, ftp, sftp, email. "
             "Leave empty to keep backups local only."
         ),
         "type": "string",
         "sensitive": False,
         "required": False,
         "restart_required": False,
-        "options": ["", "s3", "dropbox", "google_drive", "onedrive", "nextcloud", "webdav", "ftp", "sftp", "email"],
+        "options": [
+            "",
+            "s3",
+            "dropbox",
+            "google_drive",
+            "onedrive",
+            "sharepoint",
+            "nextcloud",
+            "webdav",
+            "ftp",
+            "sftp",
+            "email",
+        ],
     },
     "backup_remote_folder": {
         "category": "Backup",
@@ -2429,6 +2558,72 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": False,
     },
+    # Database Connection Pool
+    "db_pool_size": {
+        "category": "Core",
+        "description": (
+            "Number of persistent connections kept in the SQLAlchemy QueuePool. "
+            "Has no effect for SQLite databases. Default: 5."
+        ),
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "db_max_overflow": {
+        "category": "Core",
+        "description": (
+            "Maximum extra connections that can be opened beyond db_pool_size. "
+            "Has no effect for SQLite databases. Default: 10."
+        ),
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "db_pool_timeout": {
+        "category": "Core",
+        "description": (
+            "Seconds to wait for a connection from the pool before raising an error. "
+            "Has no effect for SQLite databases. Default: 30."
+        ),
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "db_pool_recycle": {
+        "category": "Core",
+        "description": (
+            "Seconds after which idle connections are recycled to prevent stale connections. "
+            "Has no effect for SQLite databases. Default: 1800 (30 minutes)."
+        ),
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    # Per-user upload rate limiting
+    "upload_rate_limit_per_user": {
+        "category": "Security",
+        "description": (
+            "Maximum number of uploads a single user may submit within upload_rate_limit_window seconds. "
+            "The health-aware limiter may reduce this dynamically under high Redis queue depth or CPU load. "
+            "Default: 20."
+        ),
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "upload_rate_limit_window": {
+        "category": "Security",
+        "description": ("Sliding window in seconds over which upload_rate_limit_per_user is enforced. Default: 60."),
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
     # Rate Limiting
     "rate_limiting_enabled": {
         "category": "Security",
@@ -2628,6 +2823,63 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": False,
     },
+    # Logging
+    "log_level": {
+        "category": "Observability",
+        "description": (
+            "Python logging level for the application root logger. "
+            "Accepts: DEBUG, INFO, WARNING, ERROR, CRITICAL. "
+            "When DEBUG=True and LOG_LEVEL is not explicitly set, "
+            "the effective level is automatically lowered to DEBUG."
+        ),
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "log_format": {
+        "category": "Observability",
+        "description": (
+            "Log output format: 'text' (human-readable, default) or "
+            "'json' (structured JSON lines for SIEM / log aggregation)."
+        ),
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "log_syslog_enabled": {
+        "category": "Observability",
+        "description": "Forward application logs to a syslog receiver in addition to stdout.",
+        "type": "boolean",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "log_syslog_host": {
+        "category": "Observability",
+        "description": "Hostname or IP of the syslog receiver for application logs.",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "log_syslog_port": {
+        "category": "Observability",
+        "description": "Port of the syslog receiver for application logs.",
+        "type": "integer",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
+    "log_syslog_protocol": {
+        "category": "Observability",
+        "description": "Protocol for syslog transport: 'udp' or 'tcp'.",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": True,
+    },
     # Observability – Sentry
     "sentry_dsn": {
         "category": "Observability",
@@ -3120,3 +3372,60 @@ def get_settings_for_export(db: Session, source: str = "db") -> Dict[str, str]:
         # DB only
         db_settings = get_all_settings_from_db(db)
         return {k.upper(): v for k, v in sorted(db_settings.items()) if v is not None}
+
+
+def update_env_file(env_path: str, settings_to_update: dict[str, str]) -> bool:
+    """
+    Update an .env file with new settings.
+
+    Reads the file, updates matching settings (even if commented),
+    appends any that weren't found, and writes the result back.
+
+    Args:
+        env_path: Path to the .env file
+        settings_to_update: Dictionary mapping setting names (e.g. 'GOOGLE_DRIVE_USE_OAUTH') to string values
+
+    Returns:
+        True if the file was successfully updated, False otherwise (e.g. file not found or write error)
+    """
+    if not os.path.exists(env_path):
+        logger.warning(f".env file not found at {env_path}, skipping file update")
+        return False
+
+    try:
+        logger.info(f"Updating settings in {env_path}")
+
+        # Read the current .env file
+        with open(env_path, "r") as f:
+            env_lines = f.readlines()
+
+        # Process each line and update or add settings
+        updated = set()
+        new_env_lines = []
+        for line in env_lines:
+            stripped_line = line.rstrip()
+            is_updated = False
+            for key, value in settings_to_update.items():
+                if stripped_line.startswith(f"{key}=") or stripped_line.startswith(f"# {key}="):
+                    # Uncomment if commented out - check the original stripped line
+                    new_env_lines.append(f"{key}={value}")
+                    updated.add(key)
+                    is_updated = True
+                    break
+            if not is_updated:
+                new_env_lines.append(stripped_line)
+
+        # Add any settings that weren't updated (they weren't in the file)
+        for key, value in settings_to_update.items():
+            if key not in updated:
+                new_env_lines.append(f"{key}={value}")
+
+        # Write the updated .env file
+        with open(env_path, "w") as f:
+            f.write("\n".join(new_env_lines) + "\n")
+
+        logger.info(f"Successfully updated settings in {env_path}")
+        return True
+    except Exception as e:
+        logger.warning(f"Failed to update {env_path}: {str(e)}")
+        return False

app/utils/system_reset.py

@@ -0,0 +1,296 @@
+"""
+System reset utilities for DocuElevate.
+
+Provides functions to:
+- Wipe all user data (database rows + work-files on disk) for a fresh start.
+- Wipe with re-import: move original files to a dedicated folder, wipe
+  everything, then let the watch-folder mechanism re-ingest the files.
+
+Security: All public functions in this module require admin-level access.
+They MUST only be invoked from admin-guarded API/view endpoints.
+"""
+
+import logging
+import shutil
+from pathlib import Path
+
+from sqlalchemy.orm import Session
+
+from app.config import settings
+
+logger = logging.getLogger(__name__)
+
+# Subdirectories inside *workdir* that contain user-generated data.
+# Everything else (app code, static assets, config) is left untouched.
+_USER_DATA_SUBDIRS = ("original", "processed", "tmp", "pdfa", "backups")
+
+# JSON cache files written by watch-folder / ingest tasks.
+_CACHE_FILES = (
+    "watch_folder_processed.json",
+    "ftp_ingest_processed.json",
+    "sftp_ingest_processed.json",
+    "dropbox_ingest_processed.json",
+    "gdrive_ingest_processed.json",
+    "onedrive_ingest_processed.json",
+    "nextcloud_ingest_processed.json",
+    "s3_ingest_processed.json",
+    "webdav_ingest_processed.json",
+    "processed_mails.json",
+    "credential_failures.json",
+)
+
+# The folder name used for storing files prior to re-import.
+REIMPORT_FOLDER_NAME = "reimport"
+
+
+def _wipe_workdir_data(workdir: str) -> dict[str, int]:
+    """Delete user data subdirectories and cache files inside *workdir*.
+
+    Leaves the workdir directory itself intact so the application can
+    continue to write into it.  Also leaves any files that do not belong
+    to the known data subdirectories or caches.
+
+    Returns:
+        A dict with counts of deleted directories and files.
+    """
+    workdir_path = Path(workdir)
+    deleted_dirs = 0
+    deleted_files = 0
+
+    # Remove data subdirectories
+    for subdir in _USER_DATA_SUBDIRS:
+        target = workdir_path / subdir
+        if target.is_dir():
+            shutil.rmtree(target)
+            logger.info("Deleted data directory: %s", target)
+            deleted_dirs += 1
+
+    # Remove cache / state JSON files
+    for cache_file in _CACHE_FILES:
+        target = workdir_path / cache_file
+        if target.is_file():
+            target.unlink()
+            logger.info("Deleted cache file: %s", target)
+            deleted_files += 1
+
+    # Also remove user_wf_*.json files (per-user watch folder caches)
+    for f in workdir_path.glob("user_wf_*.json"):
+        f.unlink()
+        logger.info("Deleted user watch-folder cache: %s", f)
+        deleted_files += 1
+
+    # Remove loose files in workdir root that are user uploads (uuid-named
+    # files like "a1b2c3d4-…pdf") but NOT application config files.
+    for entry in workdir_path.iterdir():
+        if entry.is_file() and entry.suffix.lower() in {
+            ".pdf",
+            ".png",
+            ".jpg",
+            ".jpeg",
+            ".tiff",
+            ".tif",
+            ".docx",
+            ".doc",
+            ".xlsx",
+            ".xls",
+            ".pptx",
+            ".heic",
+            ".heif",
+            ".webp",
+            ".bmp",
+            ".gif",
+            ".txt",
+            ".rtf",
+            ".odt",
+            ".ods",
+            ".odp",
+            ".csv",
+            ".pages",
+            ".numbers",
+            ".keynote",
+        }:
+            entry.unlink()
+            logger.info("Deleted loose workdir file: %s", entry)
+            deleted_files += 1
+
+    return {"deleted_dirs": deleted_dirs, "deleted_files": deleted_files}
+
+
+def _wipe_database(db: Session) -> dict[str, int]:
+    """Delete all user-generated rows from the database.
+
+    Preserves schema (tables, migrations) and system-seeded rows that will
+    be re-created on the next startup (subscription plans, default pipeline,
+    scheduled jobs, compliance templates).
+
+    Returns:
+        A dict mapping table name → number of rows deleted.
+    """
+    from app.models import (
+        AuditLog,
+        BackupRecord,
+        DocumentMetadata,
+        FileProcessingStep,
+        FileRecord,
+        InAppNotification,
+        ProcessingLog,
+        SavedSearch,
+        SettingsAuditLog,
+        SharedLink,
+        UserImapAccount,
+        UserIntegration,
+        UserNotificationPreference,
+        UserNotificationTarget,
+    )
+
+    # Order matters: delete children before parents to respect FK constraints.
+    tables_to_wipe: list[tuple[str, type]] = [
+        ("file_processing_steps", FileProcessingStep),
+        ("processing_logs", ProcessingLog),
+        ("shared_links", SharedLink),
+        ("in_app_notifications", InAppNotification),
+        ("user_notification_preferences", UserNotificationPreference),
+        ("user_notification_targets", UserNotificationTarget),
+        ("user_imap_accounts", UserImapAccount),
+        ("user_integrations", UserIntegration),
+        ("saved_searches", SavedSearch),
+        ("settings_audit_log", SettingsAuditLog),
+        ("audit_logs", AuditLog),
+        ("backup_records", BackupRecord),
+        ("document_metadata", DocumentMetadata),
+        ("files", FileRecord),
+    ]
+
+    result: dict[str, int] = {}
+    for table_name, model in tables_to_wipe:
+        try:
+            count = db.query(model).delete()
+            result[table_name] = count
+            logger.info("Wiped %d rows from %s", count, table_name)
+        except Exception:
+            logger.exception("Failed to wipe table %s during system reset", table_name)
+            db.rollback()
+            raise
+
+    db.commit()
+    return result
+
+
+def perform_full_reset(db: Session) -> dict:
+    """Perform a complete system reset: wipe database rows + work-files.
+
+    Args:
+        db: An active SQLAlchemy session.
+
+    Returns:
+        Summary dict with ``database`` and ``filesystem`` sub-dicts.
+    """
+    logger.warning(">>> SYSTEM RESET: wiping all user data <<<")
+
+    db_result = _wipe_database(db)
+    fs_result = _wipe_workdir_data(settings.workdir)
+
+    logger.warning(">>> SYSTEM RESET complete <<<")
+    return {"database": db_result, "filesystem": fs_result}
+
+
+def perform_reset_and_reimport(db: Session) -> dict:
+    """Move original files to a reimport folder, wipe everything, then
+    configure the reimport folder as a watch folder for re-ingestion.
+
+    The watch-folder scanner (``scan_all_watch_folders``) will pick up
+    the files on its next periodic run and process them exactly as if
+    they had been freshly uploaded — respecting the same backoff
+    strategy, size limits, and rate limits.
+
+    Args:
+        db: An active SQLAlchemy session.
+
+    Returns:
+        Summary dict with ``database``, ``filesystem``, and ``reimport`` sub-dicts.
+    """
+    workdir_path = Path(settings.workdir)
+    reimport_dir = workdir_path / REIMPORT_FOLDER_NAME
+    original_dir = workdir_path / "original"
+
+    # 1. Collect original files
+    files_moved = 0
+    reimport_dir.mkdir(parents=True, exist_ok=True)
+
+    if original_dir.is_dir():
+        for entry in original_dir.iterdir():
+            if entry.is_file():
+                # Validate the resolved path stays within original_dir (path traversal guard)
+                try:
+                    entry.resolve().relative_to(original_dir.resolve())
+                except ValueError:
+                    logger.warning("Skipping file outside original dir: %s", entry)
+                    continue
+                dest = reimport_dir / entry.name
+                # Avoid overwriting: append counter if name clash
+                if dest.exists():
+                    stem = dest.stem
+                    suffix = dest.suffix
+                    counter = 1
+                    while dest.exists():
+                        dest = reimport_dir / f"{stem}_{counter}{suffix}"
+                        counter += 1
+                shutil.copy2(str(entry), str(dest))
+                files_moved += 1
+
+    logger.info("Copied %d original files to reimport folder: %s", files_moved, reimport_dir)
+
+    # 2. Perform the full reset (wipe DB + other workdir data)
+    reset_result = perform_full_reset(db)
+
+    # 3. Ensure the reimport folder survived the wipe (it's not in _USER_DATA_SUBDIRS)
+    #    and set up watch folder config to point at it.
+    _configure_reimport_watch_folder(str(reimport_dir))
+
+    reset_result["reimport"] = {
+        "files_moved": files_moved,
+        "reimport_folder": str(reimport_dir),
+    }
+    logger.warning(">>> SYSTEM RESET with re-import configured — %d files staged <<<", files_moved)
+    return reset_result
+
+
+def _configure_reimport_watch_folder(reimport_path: str) -> None:
+    """Append *reimport_path* to the application's watch-folder list.
+
+    The watch-folder scanner uses ``settings.watch_folders`` (a
+    comma-separated string).  We mutate the runtime setting so the
+    next scan picks up the folder.  We also set
+    ``watch_folder_delete_after_process = True`` so files are cleaned
+    up after successful processing.
+    """
+    current = getattr(settings, "watch_folders", None) or ""
+    folders = [f.strip() for f in current.split(",") if f.strip()]
+
+    if reimport_path not in folders:
+        folders.append(reimport_path)
+
+    # Mutate runtime settings (not persisted to .env — ephemeral)
+    object.__setattr__(settings, "watch_folders", ",".join(folders))
+    object.__setattr__(settings, "watch_folder_delete_after_process", True)
+    logger.info("Configured reimport watch folder: %s", reimport_path)
+
+
+def perform_startup_reset() -> None:
+    """Called during application startup when ``FACTORY_RESET_ON_STARTUP=True``.
+
+    Wipes database and filesystem data so the instance starts completely
+    fresh.  Uses its own DB session so it runs before the normal lifespan
+    seeding logic.
+    """
+    from app.database import SessionLocal
+
+    logger.warning("FACTORY_RESET_ON_STARTUP is enabled — wiping all data")
+    db = SessionLocal()
+    try:
+        perform_full_reset(db)
+    except Exception:
+        logger.exception("Factory reset on startup failed")
+        db.rollback()
+    finally:
+        db.close()

app/utils/user_scope.py

@@ -20,13 +20,31 @@ from app.models import FileRecord
 logger = logging.getLogger(__name__)
 
 
+def _owner_id_from_user(user: dict) -> str | None:
+    """Extract the owner identifier from a user dict.
+
+    Priority: ``sub`` (OAuth subject) → ``preferred_username`` → ``email`` → ``id``.
+    """
+    return user.get("sub") or user.get("preferred_username") or user.get("email") or user.get("id")
+
+
 def get_current_owner_id(request: Request) -> str | None:
     """Extract the owner identifier for the current authenticated user.
 
-    The owner ID is derived from the user's session data.  It uses the
-    ``sub`` claim (OAuth subject) when available, falling back to
-    ``preferred_username`` or ``email``.  Returns ``None`` when no user
-    is authenticated.
+    The owner ID is derived from the user's session data or, when no session
+    is present, from a valid Bearer API token in the ``Authorization`` header.
+    This ensures that both browser-based (session cookie) and mobile/API
+    (Bearer token) requests are correctly identified.
+
+    Priority for user resolution:
+
+    1. Session ``user`` dict (set by OAuth or local login).
+    2. ``request.state.api_token_user`` (set by ``require_login`` or an
+       earlier call to this function during the same request).
+    3. Direct Bearer token look-up against the database.
+
+    Within the resolved user dict the owner ID is chosen as:
+    ``sub`` → ``preferred_username`` → ``email`` → ``id``.
 
     Args:
         request: The current FastAPI request with session data.
@@ -34,11 +52,41 @@ def get_current_owner_id(request: Request) -> str | None:
     Returns:
         A stable string identifier for the user, or ``None``.
     """
+    # 1. Session-based auth (most common for web UI)
     user = request.session.get("user")
-    if not user or not isinstance(user, dict):
-        return None
-    # Prefer 'sub' (OAuth subject), then 'preferred_username', then 'email', then 'id'
-    return user.get("sub") or user.get("preferred_username") or user.get("email") or user.get("id")
+    if user and isinstance(user, dict):
+        return _owner_id_from_user(user)
+
+    # 2. Already-resolved API token user (cached by require_login or a
+    #    prior dependency call during this request)
+    api_user = getattr(request.state, "api_token_user", None)
+    if isinstance(api_user, dict):
+        return _owner_id_from_user(api_user)
+
+    # 3. Direct Bearer token resolution – necessary when this function is
+    #    invoked as a FastAPI dependency (via Depends) which runs *before*
+    #    the @require_login decorator wrapper has had a chance to resolve
+    #    the token and populate request.state.api_token_user.
+    auth_header = request.headers.get("authorization", "")
+    if isinstance(auth_header, str) and auth_header.startswith("Bearer "):
+        try:
+            from app.auth import _resolve_bearer_user
+            from app.database import SessionLocal
+
+            db = SessionLocal()
+            try:
+                resolved = _resolve_bearer_user(request, db)
+            finally:
+                db.close()
+
+            if resolved:
+                # Cache so subsequent calls (and require_login) skip the DB
+                request.state.api_token_user = resolved
+                return _owner_id_from_user(resolved)
+        except Exception:
+            logger.debug("Bearer token resolution failed in get_current_owner_id", exc_info=True)
+
+    return None
 
 
 def apply_owner_filter(query: Query, request: Request) -> Query:

app/views/__init__.py

@@ -10,6 +10,7 @@ from app.views.audit_logs import router as audit_logs_router
 from app.views.backup import router as backup_router
 from app.views.compliance import router as compliance_router
 from app.views.db_wizard import router as db_wizard_router
+from app.views.devices import router as devices_router  # Mobile devices dashboard
 from app.views.dropbox import router as dropbox_router
 from app.views.filemanager import router as filemanager_router
 
@@ -26,6 +27,7 @@ from app.views.onedrive import router as onedrive_router
 from app.views.pipelines import router as pipelines_router  # Processing pipelines
 from app.views.plans import router as plans_router  # Admin Plan Designer
 from app.views.profile import router as profile_router  # User self-service profile
+from app.views.qr_login import router as qr_login_router  # QR code mobile login
 from app.views.queue import router as queue_router
 from app.views.scheduled_jobs import router as scheduled_jobs_router  # Scheduled batch jobs
 from app.views.search import router as search_router
@@ -34,6 +36,7 @@ from app.views.share import router as share_router
 from app.views.shared_links import router as shared_links_router
 from app.views.status import router as status_router
 from app.views.subscriptions import router as subscriptions_router  # Pricing + subscription pages
+from app.views.system_reset import router as system_reset_router  # System reset / factory reset
 from app.views.wizard import router as wizard_router
 
 # Create a main router that includes all the view routers
@@ -60,6 +63,7 @@ router.include_router(plans_router)  # Admin Plan Designer
 router.include_router(onboarding_router)  # User onboarding wizard
 router.include_router(pipelines_router)  # Processing pipelines
 router.include_router(profile_router)  # User self-service profile settings
+router.include_router(qr_login_router)  # QR code mobile login page
 router.include_router(imap_accounts_router)  # Per-user IMAP ingestion accounts
 router.include_router(integrations_router)  # Unified integrations dashboard
 router.include_router(notifications_router)  # User notification dashboard
@@ -67,3 +71,5 @@ router.include_router(scheduled_jobs_router)  # Admin scheduled batch jobs
 router.include_router(audit_logs_router)  # Comprehensive audit log viewer
 router.include_router(help_router)  # Built-in help / How-To docs
 router.include_router(compliance_router)  # Compliance templates dashboard
+router.include_router(devices_router)  # Mobile devices dashboard
+router.include_router(system_reset_router)  # System reset / factory reset

app/views/base.py

@@ -11,13 +11,15 @@ from sqlalchemy.orm import Session  # noqa: F401
 
 from app.auth import require_login  # noqa: F401
 from app.config import settings
-from app.database import get_db  # noqa: F401
+from app.database import SessionLocal, get_db  # noqa: F401
+from app.models import UserProfile
 from app.utils.i18n import (
     SUPPORTED_LANGUAGES,
     detect_language,
     format_date,
     format_datetime,
     format_number,
+    get_suggested_languages,
     translate,
 )
 
@@ -46,6 +48,41 @@ templates.env.globals["_"] = lambda key, **kwargs: translate(key, "en", **kwargs
 original_template_response = templates.TemplateResponse
 
 
+def _hydrate_language_from_db(request: Request, session_user: object) -> None:
+    """Load the user's preferred language from the DB into the session.
+
+    Called once per session when ``preferred_language`` is not yet in the
+    session.  A lightweight DB query fetches the stored preference so that
+    :func:`detect_language` picks it up from the session on all subsequent
+    requests without further DB access.
+    """
+    from app.utils.i18n import SUPPORTED_LANGUAGE_CODES
+
+    user_id: str | None = None
+    if isinstance(session_user, dict):
+        user_id = (
+            session_user.get("sub")
+            or session_user.get("preferred_username")
+            or session_user.get("email")
+            or session_user.get("id")
+        )
+    elif isinstance(session_user, str):
+        user_id = session_user
+
+    if not user_id:
+        return
+
+    db = SessionLocal()
+    try:
+        profile = db.query(UserProfile).filter(UserProfile.user_id == user_id).first()
+        if profile and profile.preferred_language and profile.preferred_language in SUPPORTED_LANGUAGE_CODES:
+            request.session["preferred_language"] = profile.preferred_language
+    except Exception:  # noqa: BLE001 — intentionally broad; DB may be temporarily unavailable
+        logger.debug("Could not hydrate language preference for user_id=%s", user_id)
+    finally:
+        db.close()
+
+
 def _inject_global_context(ctx: dict) -> None:
     """Inject shared global variables into every template context dict."""
     ctx.setdefault("version", settings.version)
@@ -57,6 +94,7 @@ def _inject_global_context(ctx: dict) -> None:
         "allow_signup",
         getattr(settings, "multi_user_enabled", False) and getattr(settings, "allow_local_signup", False),
     )
+    ctx.setdefault("enable_factory_reset", getattr(settings, "enable_factory_reset", False))
 
     req = ctx.get("request")
     if req is not None:
@@ -70,10 +108,22 @@ def _inject_global_context(ctx: dict) -> None:
         # When auth is disabled every visitor is effectively "logged in"
         ctx.setdefault("is_logged_in", not getattr(settings, "auth_enabled", True) or session_user is not None)
 
+        # --- Hydrate session language from DB (once per session) ---
+        # If the session doesn't have a preferred_language yet but the user
+        # is logged in, load the stored preference from the database so that
+        # detect_language() picks it up from the session on this and all
+        # subsequent requests.
+        if hasattr(req, "session") and "preferred_language" not in req.session and session_user is not None:
+            _hydrate_language_from_db(req, session_user)
+
         # --- i18n: detect language and register template helpers ---
         current_locale = detect_language(req)
         ctx.setdefault("current_locale", current_locale)
 
+        # Smart language suggestions for the compact nav-bar dropdown (5-7 languages)
+        accept_header = req.headers.get("accept-language", "") if hasattr(req, "headers") else ""
+        ctx.setdefault("suggested_languages", get_suggested_languages(current_locale, accept_header))
+
         def _translate(key: str, **kwargs: object) -> str:
             return translate(key, current_locale, **kwargs)
 
@@ -97,12 +147,36 @@ def _inject_global_context(ctx: dict) -> None:
 
 
 def template_response_with_version(*args, **kwargs):
-    """Wrapper for TemplateResponse to include version and CSRF token in all templates"""
-    # If context dict is provided, add version to it
-    if len(args) >= 2 and isinstance(args[1], dict):
-        _inject_global_context(args[1])
-    elif "context" in kwargs and isinstance(kwargs["context"], dict):
+    """Wrapper for TemplateResponse to include version and CSRF token in all templates.
+
+    Handles both old-style and new-style Starlette TemplateResponse calls:
+      - Old-style (Starlette <1.0): TemplateResponse(name, {"request": req, ...}, ...)
+      - New-style (Starlette 1.0+): TemplateResponse(request, name, context={...}, ...)
+    """
+    if len(args) >= 1 and isinstance(args[0], str):
+        # Old-style call: first positional arg is the template name (string).
+        # Convert to new-style: (request, name, context=..., ...)
+        name = args[0]
+        if len(args) >= 2 and isinstance(args[1], dict):
+            context = args[1]
+            # Old-style may have status_code as 3rd positional arg
+            if len(args) >= 3 and "status_code" not in kwargs:
+                kwargs["status_code"] = args[2]
+        else:
+            context = kwargs.pop("context", {})
+        request_obj = context.pop("request", None)
+        if request_obj is not None:
+            context["request"] = request_obj
+        _inject_global_context(context)
+        if request_obj is not None:
+            return original_template_response(request_obj, name, context=context, **kwargs)
+        return original_template_response(name, context=context, **kwargs)
+
+    # New-style call: (request, name, context=..., ...)
+    if "context" in kwargs and isinstance(kwargs["context"], dict):
         _inject_global_context(kwargs["context"])
+    elif len(args) >= 3 and isinstance(args[2], dict):
+        _inject_global_context(args[2])
     return original_template_response(*args, **kwargs)
 
 

app/views/devices.py

@@ -0,0 +1,25 @@
+"""View route for the Devices management page.
+
+Renders the ``devices.html`` template where users can see their registered
+mobile devices, mobile API tokens (created via the mobile SSO flow or QR
+code login), and revoke access per-device.
+"""
+
+import logging
+
+from fastapi import APIRouter, Request
+
+from app.views.base import require_login, templates
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+@router.get("/devices", include_in_schema=False)
+@require_login
+async def devices_page(request: Request):
+    """Render the Devices management page."""
+    return templates.TemplateResponse(
+        "devices.html",
+        {"request": request, "page_title": "Devices"},
+    )

app/views/files.py

@@ -832,6 +832,34 @@ def get_processed_text(request: Request, file_id: int, db: Session = Depends(get
         )
 
 
+@router.get("/files/{file_id}/text/default-language")
+@require_login
+def get_default_language_text(request: Request, file_id: int, db: Session = Depends(get_db)):
+    """Return the persisted default-language translation for the file view."""
+    from fastapi import status
+    from fastapi.responses import JSONResponse
+
+    from app.models import FileRecord
+
+    file_record = db.query(FileRecord).filter(FileRecord.id == file_id).first()
+    if not file_record:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=_FILE_NOT_FOUND)
+
+    if not file_record.default_language_text:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="No default-language translation available",
+        )
+
+    return JSONResponse(
+        content={
+            "text": file_record.default_language_text,
+            "language_code": file_record.default_language_code,
+            "detected_language": file_record.detected_language,
+        }
+    )
+
+
 @router.get("/duplicates")
 @require_login
 def duplicates_page(

app/views/qr_login.py

@@ -0,0 +1,26 @@
+"""View route for the QR code mobile login page.
+
+Route:
+  GET /qr-login  — renders the QR login page (requires login)
+"""
+
+from __future__ import annotations
+
+import logging
+
+from fastapi import Request
+
+from app.views.base import APIRouter, require_login, templates
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+@router.get("/qr-login", include_in_schema=False)
+@require_login
+async def qr_login_page(request: Request):
+    """Serve the QR code login page for mobile app authentication."""
+    return templates.TemplateResponse(
+        "qr_login.html",
+        {"request": request},
+    )

app/views/system_reset.py

@@ -0,0 +1,40 @@
+"""
+System reset view — admin-only UI page.
+
+Renders a confirmation-heavy page that allows administrators to:
+1. **Full Reset** — wipe all user data (DB + disk) for a fresh start.
+2. **Reset & Re-import** — move originals to a reimport folder, wipe,
+   and let the watch-folder mechanism re-ingest them.
+
+Both options are gated behind the ``ENABLE_FACTORY_RESET`` feature flag.
+"""
+
+import logging
+
+from fastapi import Depends, Request
+from fastapi.responses import RedirectResponse, Response
+from sqlalchemy.orm import Session
+
+from app.config import settings
+from app.views.base import APIRouter, get_db, require_login, templates
+from app.views.settings import require_admin_access
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+@router.get("/admin/system-reset")
+@require_login
+@require_admin_access
+async def system_reset_page(request: Request, db: Session = Depends(get_db)) -> Response:
+    """Render the system reset administration page."""
+    if not settings.enable_factory_reset:
+        return RedirectResponse(url="/settings", status_code=302)
+
+    return templates.TemplateResponse(
+        "system_reset.html",
+        {
+            "request": request,
+            "factory_reset_on_startup": settings.factory_reset_on_startup,
+        },
+    )

benchmark_duplicates.py

@@ -0,0 +1,101 @@
+import time
+import os
+import sys
+import asyncio
+
+# Mock settings before app imports to bypass validation
+os.environ["DATABASE_URL"] = "sqlite:///:memory:"
+os.environ["REDIS_URL"] = "redis://localhost:6379"
+os.environ["OPENAI_API_KEY"] = "mock_key"
+os.environ["WORKDIR"] = "/tmp/workdir"
+os.environ["AZURE_AI_KEY"] = "mock"
+os.environ["AZURE_REGION"] = "mock"
+os.environ["AZURE_ENDPOINT"] = "http://mock"
+os.environ["GOTENBERG_URL"] = "http://mock"
+os.environ["SESSION_SECRET"] = "mock_secret_mock_secret_mock_secret_mock_secret"
+
+# Ensure app package is accessible
+sys.path.insert(0, os.path.abspath(os.path.dirname(__file__)))
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+from app.database import Base
+from app.models import FileRecord
+from app.api.duplicates import list_duplicate_groups
+
+# Mocking Request object
+class MockRequest:
+    def __init__(self):
+        self.session = {"user": {"username": "testuser"}}
+        self.state = type('State', (), {'user': {"username": "testuser"}})()
+
+    class MockURL:
+        def include_query_params(self, **kwargs):
+            return f"http://testserver/api/duplicates?page={kwargs.get('page')}"
+    url = MockURL()
+
+def setup_db():
+    engine = create_engine('sqlite:///:memory:')
+    Base.metadata.create_all(engine)
+    Session = sessionmaker(bind=engine)
+    db = Session()
+    return db
+
+def populate_data(db, num_groups, duplicates_per_group):
+    for i in range(num_groups):
+        filehash = f"hash_{i}"
+        # Original
+        original = FileRecord(
+            filehash=filehash,
+            local_filename=f"orig_{i}.txt",
+            file_size=100,
+            is_duplicate=False
+        )
+        db.add(original)
+        # Duplicates
+        for j in range(duplicates_per_group):
+            dup = FileRecord(
+                filehash=filehash,
+                local_filename=f"dup_{i}_{j}.txt",
+                file_size=100,
+                is_duplicate=True
+            )
+            db.add(dup)
+    db.commit()
+
+async def run_benchmark(db):
+    request = MockRequest()
+    start_time = time.time()
+
+    # Run the function we want to benchmark
+    result = list_duplicate_groups(request=request, db=db, page=1, per_page=500)
+    if asyncio.iscoroutine(result):
+        result = await result
+
+    end_time = time.time()
+    return end_time - start_time, result
+
+async def main():
+    db = setup_db()
+    # 500 groups, each with 20 duplicates = 10500 records total
+    print("Populating data...")
+    populate_data(db, 500, 20)
+    print("Data populated. Running baseline benchmark...")
+
+    # Warmup
+    result = list_duplicate_groups(request=MockRequest(), db=db, page=1, per_page=500)
+    if asyncio.iscoroutine(result):
+        await result
+
+    # Benchmark
+    total_time = 0
+    iterations = 10
+    for _ in range(iterations):
+        time_taken, _ = await run_benchmark(db)
+        total_time += time_taken
+
+    avg_time = total_time / iterations
+    print(f"Average time over {iterations} iterations: {avg_time:.4f} seconds")
+
+if __name__ == "__main__":
+    asyncio.run(main())

benchmark_notifications.py

@@ -0,0 +1,50 @@
+import json
+import time
+import pytest
+from app.database import get_db
+from app.models import UserNotificationTarget, UserNotificationPreference
+from app.main import app
+from tests.test_notifications_api import _make_client, _OWNER, _cleanup
+import statistics
+
+def run_benchmark(notif_engine, notif_session, client, items_count, iterations=5):
+    # Setup
+    target = UserNotificationTarget(
+        owner_id=_OWNER,
+        channel_type="webhook",
+        name="My Webhook",
+        config=json.dumps({"url": "https://x.com"}),
+    )
+    notif_session.add(target)
+    notif_session.commit()
+    notif_session.refresh(target)
+
+    # Generate big payload
+    preferences = []
+    for i in range(items_count):
+        preferences.append({
+            "event_type": f"event.type.{i}",
+            "channel_type": "webhook",
+            "is_enabled": True,
+            "target_id": target.id,
+        })
+
+    payload = {"preferences": preferences}
+
+    # Warm up
+    client.put("/api/user-notifications/preferences", json=payload)
+
+    times = []
+    for _ in range(iterations):
+        # Alter the values a bit so it's a real update
+        for p in payload["preferences"]:
+            p["is_enabled"] = not p["is_enabled"]
+
+        start = time.time()
+        resp = client.put("/api/user-notifications/preferences", json=payload)
+        end = time.time()
+
+        assert resp.status_code == 200
+        times.append(end - start)
+
+    return statistics.mean(times)

benchmark_onedrive.py

@@ -0,0 +1,69 @@
+import asyncio
+import time
+import httpx
+from unittest.mock import patch, MagicMock, AsyncMock
+from app.api.onedrive import test_onedrive_token
+from app.config import settings
+
+settings.onedrive_refresh_token = "dummy"
+settings.onedrive_client_id = "dummy"
+settings.onedrive_client_secret = "dummy"
+
+class DummyRequest:
+    def __init__(self):
+        self.session = {"user": "dummy"}
+
+async def run_benchmark(func_name, mock_post, mock_get):
+    mock_post_resp = MagicMock()
+    mock_post_resp.status_code = 200
+    mock_post_resp.json.return_value = {
+        "access_token": "dummy_access",
+        "expires_in": 3600
+    }
+    mock_post.return_value = mock_post_resp
+
+    mock_get_resp = MagicMock()
+    mock_get_resp.status_code = 200
+    mock_get_resp.json.return_value = {
+        "displayName": "Test User",
+        "userPrincipalName": "test@example.com"
+    }
+    mock_get.return_value = mock_get_resp
+
+    start_time = time.time()
+    for _ in range(100):
+        await test_onedrive_token(DummyRequest())
+    end_time = time.time()
+    print(f"{func_name} took {end_time - start_time:.4f} seconds")
+
+async def run_benchmark_async(func_name, mock_post, mock_get):
+    mock_post_resp = MagicMock()
+    mock_post_resp.status_code = 200
+    mock_post_resp.json = MagicMock(return_value={
+        "access_token": "dummy_access",
+        "expires_in": 3600
+    })
+    mock_post.return_value = mock_post_resp
+
+    mock_get_resp = MagicMock()
+    mock_get_resp.status_code = 200
+    mock_get_resp.json = MagicMock(return_value={
+        "displayName": "Test User",
+        "userPrincipalName": "test@example.com"
+    })
+    mock_get.return_value = mock_get_resp
+
+    start_time = time.time()
+    for _ in range(100):
+        await test_onedrive_token(DummyRequest())
+    end_time = time.time()
+    print(f"{func_name} took {end_time - start_time:.4f} seconds")
+
+
+@patch('app.api.onedrive.requests.get')
+@patch('app.api.onedrive.requests.post')
+def benchmark_sync(mock_post, mock_get):
+    asyncio.run(run_benchmark("Sync requests (baseline)", mock_post, mock_get))
+
+if __name__ == "__main__":
+    benchmark_sync()

benchmark_url_upload.py

@@ -0,0 +1,49 @@
+import asyncio
+import time
+from unittest.mock import Mock, patch
+
+from app.api.url_upload import process_url, URLUploadRequest
+from app.config import settings
+
+async def main():
+    # Mock request and URLUploadRequest
+    request = Mock()
+    url_request = URLUploadRequest(url="https://example.com/file.pdf")
+
+    # Generate a large chunk
+    large_chunk = b"A" * 8192
+    num_chunks = 10000 # 8192 * 10000 = ~80MB
+
+    mock_response = Mock()
+    mock_response.status_code = 200
+    mock_response.headers = {"Content-Type": "application/pdf"}
+    mock_response.iter_content = Mock(return_value=[large_chunk] * num_chunks)
+
+    # For async client later
+    class AsyncMockResponse:
+        def __init__(self):
+            self.status_code = 200
+            self.headers = {"Content-Type": "application/pdf"}
+        def raise_for_status(self):
+            pass
+        async def aiter_bytes(self, chunk_size):
+            for _ in range(num_chunks):
+                yield large_chunk
+
+    async_mock_response = AsyncMockResponse()
+
+    # We will mock requests.get for synchronous, httpx.AsyncClient.get for asynchronous
+
+    # Test sync
+    start_time = time.time()
+    with patch("app.api.url_upload.requests.get", return_value=mock_response), \
+         patch("app.api.url_upload.process_document"):
+        try:
+            await process_url(request=request, url_request=url_request)
+        except Exception as e:
+            print(f"Error: {e}")
+    end_time = time.time()
+    print(f"Original execution time (sync writing): {end_time - start_time:.4f} seconds")
+
+if __name__ == "__main__":
+    asyncio.run(main())

benchmark_url_upload2.py

@@ -0,0 +1,75 @@
+import asyncio
+import time
+import os
+import shutil
+import tempfile
+from unittest.mock import Mock, patch
+from fastapi import HTTPException
+
+from app.api.url_upload import process_url, URLUploadRequest
+from app.config import settings
+
+async def main():
+    # Setup test dir
+    test_dir = tempfile.mkdtemp()
+    settings.workdir = test_dir
+
+    # Mock request and URLUploadRequest
+    request = Mock()
+    url_request = URLUploadRequest(url="https://example.com/file.pdf")
+
+    # Generate a large chunk
+    chunk_size = 8192
+    num_chunks = 20000 # 20000 * 8192 = ~160MB
+    large_chunk = b"A" * chunk_size
+
+    class SyncMockResponse:
+        def __init__(self):
+            self.status_code = 200
+            self.headers = {"Content-Type": "application/pdf"}
+        def raise_for_status(self):
+            pass
+        def iter_content(self, chunk_size):
+            for _ in range(num_chunks):
+                # sleep slightly to simulate network latency, otherwise OS file cache obscures the difference
+                time.sleep(0.0001)
+                yield large_chunk
+
+    sync_mock_response = SyncMockResponse()
+
+    class AsyncMockResponse:
+        def __init__(self):
+            self.status_code = 200
+            self.headers = {"Content-Type": "application/pdf"}
+            self.is_success = True
+            self.status_code = 200
+        def raise_for_status(self):
+            pass
+        async def aiter_bytes(self, chunk_size=8192):
+            for _ in range(num_chunks):
+                await asyncio.sleep(0.0001)
+                yield large_chunk
+
+    class AsyncMockContext:
+        async def __aenter__(self):
+            return AsyncMockResponse()
+        async def __aexit__(self, exc_type, exc_val, exc_tb):
+            pass
+
+    async_mock_response = AsyncMockResponse()
+
+    # Test sync
+    start_time = time.time()
+    with patch("app.api.url_upload.requests.get", return_value=sync_mock_response), \
+         patch("app.api.url_upload.process_document"):
+        try:
+            await process_url(request=request, url_request=url_request)
+        except Exception as e:
+            print(f"Error (sync): {e}")
+    end_time = time.time()
+    print(f"Original execution time (sync writing): {end_time - start_time:.4f} seconds")
+
+    shutil.rmtree(test_dir)
+
+if __name__ == "__main__":
+    asyncio.run(main())

docs/API.md

@@ -2405,3 +2405,64 @@ query GetDocument($id: Int!) {
 }
 ```
 Variables: `{ "id": 42 }`
+
+## System Reset
+
+Admin-only endpoints for resetting the system to a clean state.  Requires `ENABLE_FACTORY_RESET=True`.
+
+### GET /api/admin/system-reset/status
+
+Check whether the system reset feature is enabled.
+
+**Response (200):**
+```json
+{
+  "enabled": true,
+  "factory_reset_on_startup": false
+}
+```
+
+### POST /api/admin/system-reset/full
+
+Wipe all user data (database + work-files).
+
+**Request:**
+```json
+{
+  "confirmation": "DELETE"
+}
+```
+
+**Response (200):**
+```json
+{
+  "status": "ok",
+  "result": {
+    "database": { "files": 42, "processing_logs": 100 },
+    "filesystem": { "deleted_dirs": 5, "deleted_files": 12 }
+  }
+}
+```
+
+### POST /api/admin/system-reset/reimport
+
+Move original files to a reimport folder, wipe everything, and configure the reimport folder as a watch folder for re-ingestion.
+
+**Request:**
+```json
+{
+  "confirmation": "REIMPORT"
+}
+```
+
+**Response (200):**
+```json
+{
+  "status": "ok",
+  "result": {
+    "database": { "files": 42 },
+    "filesystem": { "deleted_dirs": 5, "deleted_files": 12 },
+    "reimport": { "files_moved": 42, "reimport_folder": "/workdir/reimport" }
+  }
+}
+```

docs/AuthenticationSetup.md

@@ -154,6 +154,62 @@ DocuElevate can work with any OpenID Connect-compliant provider, not just Authen
    OAUTH_PROVIDER_NAME=Auth0
    ```
 
+## Server-Side Session Management
+
+DocuElevate supports server-side session tracking. Every login creates a `UserSession` record that can be listed and revoked individually or all at once ("log off everywhere").
+
+### Configuration
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `SESSION_LIFETIME_DAYS` | Number of days before a session expires | `30` |
+| `SESSION_LIFETIME_CUSTOM_DAYS` | Override for `SESSION_LIFETIME_DAYS` when set | — |
+
+### Managing Sessions
+
+Users can manage their active sessions from the **Profile → Security** section:
+
+- **View active sessions** — see browser, device, IP address, and last activity for each session.
+- **Revoke a single session** — immediately invalidate one session.
+- **Log off everywhere** — revoke all sessions (optionally keeping the current one) and all API tokens at once.
+
+Expired sessions are automatically cleaned up by a periodic background task.
+
+### API Endpoints
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `GET` | `/api/sessions` | List the current user's active sessions |
+| `DELETE` | `/api/sessions/{id}` | Revoke a single session |
+| `POST` | `/api/sessions/revoke-all` | Revoke all sessions for the current user |
+
+## QR Code Login
+
+QR code login allows users to authenticate a mobile device by scanning a QR code displayed in the web UI, without manually entering credentials on the phone.
+
+### How It Works
+
+1. The authenticated web user opens the **QR Login** page and a challenge QR code is displayed.
+2. The user opens the DocuElevate mobile app and taps **Scan QR Code to Login**, which opens the device camera.
+3. The mobile app scans the QR code. The QR code contains both the challenge token and the server URL (`docuelevate://qr-login?token=...&server=...`), so there is no need to enter the server URL manually.
+4. An API token is issued for the mobile device and the web UI is notified via polling.
+
+> **Note:** The countdown timer on the web page uses server-relative time (TTL in seconds) rather than absolute timestamps, so it works correctly even when the client's clock is not in sync with the server.
+
+### Configuration
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `QR_LOGIN_CHALLENGE_TTL_SECONDS` | How long a QR challenge is valid (seconds) | `120` |
+
+### API Endpoints
+
+| Method | Path | Description |
+|--------|------|-------------|
+| `POST` | `/api/qr-auth/challenge` | Create a new QR login challenge (returns `ttl_seconds` for client countdown) |
+| `GET` | `/api/qr-auth/challenge/{id}/status` | Poll the status of a challenge |
+| `POST` | `/api/qr-auth/claim` | Claim a challenge from a mobile device |
+
 ## Security Considerations
 
 1. **Always use HTTPS** in production to protect authentication tokens and passwords

docs/ConfigurationGuide.md

@@ -17,6 +17,8 @@ Configuration is primarily done through environment variables specified in a `.e
 | `EXTERNAL_HOSTNAME`    | The external hostname for the application.             | `docuelevate.example.com`      |
 | `ALLOW_FILE_DELETE`    | Enable file deletion in the web interface (`true`/`false`). | `true`                      |
 | `COMPLIANCE_ENABLED`   | Enable the compliance templates dashboard (GDPR, HIPAA, SOC 2). | `true`                      |
+| `FACTORY_RESET_ON_STARTUP` | Wipe all user data on every startup (demo/testing). | `false` |
+| `ENABLE_FACTORY_RESET` | Show the System Reset page in the admin UI.         | `false` |
 
 ### Batch Processing Settings
 
@@ -364,6 +366,9 @@ Credentials are encrypted at rest using Fernet encryption.
 |-------------------------|---------------------------------------------------------------|
 | `AUTH_ENABLED`          | Enable or disable authentication (`true`/`false`).           |
 | `SESSION_SECRET`        | Secret key used to encrypt sessions and cookies (at least 32 chars). |
+| `SESSION_LIFETIME_DAYS` | Number of days before a server-side session expires. Default: `30`. |
+| `SESSION_LIFETIME_CUSTOM_DAYS` | Override for `SESSION_LIFETIME_DAYS` when set.        |
+| `QR_LOGIN_CHALLENGE_TTL_SECONDS` | How long a QR login challenge is valid (seconds). Default: `120`. |
 | `ADMIN_USERNAME`        | Username for basic authentication (when not using OIDC).     |
 | `ADMIN_PASSWORD`        | Password for basic authentication (when not using OIDC).     |
 | `ADMIN_GROUP_NAME`      | Group name in OIDC claims that grants admin access. Default: `admin`. |
@@ -457,6 +462,87 @@ default overage buffer applied across all plans.
 
 DocuElevate supports HTTP security headers to improve browser-side security. **These headers are disabled by default** since most deployments use a reverse proxy (Traefik, Nginx, etc.) that already adds them. Enable only if deploying directly without a reverse proxy. See [Deployment Guide - Security Headers](DeploymentGuide.md#security-headers) for detailed configuration examples.
 
+### Application Logging
+
+DocuElevate uses Python's standard `logging` module. Two environment variables control log verbosity:
+
+| **Variable** | **Description** | **Default** |
+|-------------|----------------|-------------|
+| `LOG_LEVEL` | Root logger level. Accepts standard Python level names: `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL`. | `INFO` |
+| `DEBUG` | Enable debug mode. When `true` **and** `LOG_LEVEL` is **not** explicitly set, the effective log level is automatically lowered to `DEBUG`. | `false` |
+
+**Precedence rules (standard behaviour):**
+
+1. If `LOG_LEVEL` is explicitly set, it always wins — regardless of `DEBUG`.
+2. If only `DEBUG=true` is set (no `LOG_LEVEL`), the effective level becomes `DEBUG`.
+3. If neither is set, the default level is `INFO`.
+
+```bash
+# Typical production (default)
+# LOG_LEVEL=INFO
+
+# Quick debug mode — sets level to DEBUG automatically
+DEBUG=true
+
+# Explicit level override (DEBUG flag is ignored for level selection)
+LOG_LEVEL=WARNING
+```
+
+> **Tip:** At `DEBUG` level, noisy third-party libraries (httpx, authlib, urllib3, etc.) are automatically pinned to `WARNING` so that application debug output remains readable.
+
+#### Structured JSON Logging
+
+Set `LOG_FORMAT=json` to emit structured JSON lines on stdout — one JSON object per log message. This is the standard format for log collectors and SIEM tools:
+
+| **Variable** | **Description** | **Default** |
+|-------------|----------------|-------------|
+| `LOG_FORMAT` | Log output format: `text` (human-readable) or `json` (structured JSON lines). | `text` |
+
+Each JSON log line contains: `timestamp` (ISO 8601), `level`, `logger`, `message`, `module`, `funcName`, `lineno`, and `exc_info` (when an exception is logged).
+
+```bash
+# Enable JSON logging for SIEM / log aggregation
+LOG_FORMAT=json
+```
+
+**Example JSON output:**
+```json
+{"timestamp": "2025-03-16T09:18:05.192000+00:00", "level": "INFO", "logger": "app.auth", "message": "[SECURITY] OAUTH_LOGIN_SUCCESS user=alice@example.com admin=False", "module": "auth", "funcName": "oauth_callback", "lineno": 654}
+```
+
+**Compatible with:**
+- **Grafana Loki** — Promtail scrapes JSON from Docker stdout
+- **Splunk** — Universal Forwarder or HEC with JSON sourcetype
+- **ELK / OpenSearch** — Filebeat with JSON codec
+- **Datadog** — Agent auto-parses JSON logs
+- **Fluentd / Vector** — JSON input plugin
+- **Docker log drivers** — `--log-driver=json-file` (default) preserves structure
+
+#### Syslog Forwarding (Application Logs)
+
+For traditional (non-container) deployments, application logs can be forwarded directly to a syslog receiver. This is **separate** from audit-log SIEM forwarding (see below) — it sends _every_ Python log message, not just audit events.
+
+| **Variable** | **Description** | **Default** |
+|-------------|----------------|-------------|
+| `LOG_SYSLOG_ENABLED` | Forward application logs to a syslog receiver in addition to stdout. | `false` |
+| `LOG_SYSLOG_HOST` | Hostname or IP of the syslog receiver. | `localhost` |
+| `LOG_SYSLOG_PORT` | Port of the syslog receiver. | `514` |
+| `LOG_SYSLOG_PROTOCOL` | Protocol: `udp` or `tcp`. | `udp` |
+
+```bash
+# Forward all application logs to syslog
+LOG_SYSLOG_ENABLED=true
+LOG_SYSLOG_HOST=syslog.internal.example.com
+LOG_SYSLOG_PORT=514
+LOG_SYSLOG_PROTOCOL=udp
+
+# Combine with JSON format for structured syslog messages
+LOG_FORMAT=json
+LOG_SYSLOG_ENABLED=true
+```
+
+> **Note:** When `LOG_FORMAT=json`, syslog messages are also sent as JSON. When `LOG_FORMAT=text`, syslog messages use the standard `name - level - message` format.
+
 ### Audit Logging
 
 DocuElevate provides comprehensive audit logging that records significant actions (logins, document CRUD, settings changes) to an append-only database table. Every entry captures the timestamp, user, action, resource, client IP, and optional JSON details.
@@ -853,6 +939,48 @@ OPENAI_API_KEY=sk-ant-...   # passed as the api_key to LiteLLM
 
 ---
 
+### Document Translation
+
+After processing, DocuElevate can automatically translate a document's extracted text into a configurable *default language* (e.g. English). This reference translation is stored alongside the original text so users always have a version in a language they understand.
+
+Other languages are translated **on the fly** via the AI provider and are not persisted.
+
+#### Settings
+
+| **Variable**                 | **Description**                                                                                           | **Default** |
+|------------------------------|-----------------------------------------------------------------------------------------------------------|-------------|
+| `DEFAULT_DOCUMENT_LANGUAGE`  | ISO 639-1 code for the default translation target (e.g. `en`, `de`, `fr`). Documents whose detected language differs are automatically translated into this language after processing. | `en`        |
+
+Each user can override this global default in their profile (`UserProfile.default_document_language`).
+
+#### How It Works
+
+1. During metadata extraction the AI detects the document language (stored as `detected_language` on the file record).
+2. If the detected language differs from the default target language, a background Celery task (`translate_to_default_language`) translates the extracted text.
+3. The translated text is persisted in `default_language_text` and the target code in `default_language_code`.
+4. The file detail view shows both the original text and the default-language version.
+5. Users can also request on-the-fly translations to any language via the **Translate** dropdown.
+
+#### API Endpoints
+
+| **Endpoint**                                  | **Method** | **Description**                                                        |
+|-----------------------------------------------|------------|------------------------------------------------------------------------|
+| `/api/files/{id}/translation/default`         | GET        | Returns the persisted default-language translation (404 if unavailable)|
+| `/api/files/{id}/translate?lang=xx`           | GET        | On-the-fly translation to any ISO 639-1 language code                  |
+| `/files/{id}/text/default-language`           | GET        | View endpoint returning the default-language text as JSON              |
+
+#### Example
+
+```bash
+# Get the stored English translation of a German document
+curl http://localhost:8000/api/files/42/translation/default
+
+# Translate on the fly to French
+curl "http://localhost:8000/api/files/42/translate?lang=fr"
+```
+
+---
+
 ### OCR Providers
 
 DocuElevate supports multiple OCR engines that can be used individually or in combination. Configure the list of active providers with `OCR_PROVIDERS` and tune each provider with the settings below.
@@ -1161,6 +1289,20 @@ For detailed setup instructions, see the [Google Drive Setup Guide](GoogleDriveS
 
 For detailed setup instructions, see the [OneDrive Setup Guide](OneDriveSetup.md).
 
+### SharePoint Online
+
+| **Variable**                    | **Description**                                       |
+|---------------------------------|-------------------------------------------------------|
+| `SHAREPOINT_CLIENT_ID`          | Azure AD application client ID                        |
+| `SHAREPOINT_CLIENT_SECRET`      | Azure AD application client secret                    |
+| `SHAREPOINT_TENANT_ID`          | Azure AD tenant ID (use "common" for multi-tenant apps) |
+| `SHAREPOINT_REFRESH_TOKEN`      | OAuth 2.0 refresh token                               |
+| `SHAREPOINT_SITE_URL`           | SharePoint site URL (e.g. `https://tenant.sharepoint.com/sites/sitename`) |
+| `SHAREPOINT_DOCUMENT_LIBRARY`   | Document library name (default: `Documents`)          |
+| `SHAREPOINT_FOLDER_PATH`        | Subfolder path inside the document library            |
+
+SharePoint uses the same Microsoft Graph API as OneDrive. See the [OneDrive Setup Guide](OneDriveSetup.md) for Azure AD app registration instructions — the same app registration can be reused for SharePoint with the `Sites.ReadWrite.All` permission.
+
 ### Amazon S3
 
 | **Variable**                    | **Description**                                       |
@@ -1500,6 +1642,7 @@ For example:
 | S3           | `docs/uploads/`             | `docs/uploads/pdfa/`             |
 | Nextcloud    | `/Files`                    | `/Files/pdfa`                    |
 | OneDrive     | `Documents/Uploads`         | `Documents/Uploads/pdfa`         |
+| SharePoint   | `Uploads`                   | `Uploads/pdfa`                   |
 | Google Drive | *(folder ID)*               | `GOOGLE_DRIVE_PDFA_FOLDER_ID`    |
 
 Set `PDFA_UPLOAD_FOLDER` to an empty string to upload PDF/A files into the
@@ -1706,6 +1849,15 @@ ONEDRIVE_TENANT_ID=common
 ONEDRIVE_REFRESH_TOKEN=your_refresh_token
 ONEDRIVE_FOLDER_PATH=Documents/Uploads
 
+# SharePoint Online
+SHAREPOINT_CLIENT_ID=12345678-1234-1234-1234-123456789012
+SHAREPOINT_CLIENT_SECRET=your_client_secret
+SHAREPOINT_TENANT_ID=your-tenant-id
+SHAREPOINT_REFRESH_TOKEN=your_refresh_token
+SHAREPOINT_SITE_URL=https://tenant.sharepoint.com/sites/sitename
+SHAREPOINT_DOCUMENT_LIBRARY=Documents
+SHAREPOINT_FOLDER_PATH=Uploads
+
 # Amazon S3
 AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
 AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
@@ -1733,6 +1885,52 @@ BACKUP_RETAIN_WEEKLY=13
 
 You can choose which document storage services to use by only including the relevant environment variables. For example, if you only want to use Dropbox, include only the Dropbox variables and omit the Paperless NGX and Nextcloud variables.
 
+## System Reset / Factory Reset
+
+DocuElevate provides two mechanisms for resetting the system to a clean state.  Both are **disabled by default** and must be explicitly enabled.
+
+### Automatic Reset on Startup
+
+Set `FACTORY_RESET_ON_STARTUP=true` to wipe all user data (database rows and work-files) every time the application starts.  This is useful for demo, testing, or ephemeral environments where you always want a fresh instance.
+
+```dotenv
+FACTORY_RESET_ON_STARTUP=true
+```
+
+> **Warning:** This destroys all documents, processing history, audit logs, and backups on every restart.  Application settings and configuration are preserved.
+
+### Admin UI Reset Page
+
+Set `ENABLE_FACTORY_RESET=true` to display the **System Reset** page in the admin navigation menu.  From this page, administrators can:
+
+| Action | Confirmation | Description |
+|--------|-------------|-------------|
+| **Full Reset** | Type `DELETE` | Wipes all database rows and work-files.  The system returns to its initial state. |
+| **Reset & Re-import** | Type `REIMPORT` | Copies original files to a `reimport/` folder inside the workdir, wipes everything, then configures the reimport folder as a watch folder so files are automatically re-ingested with the same processing pipeline, rate limits, and backoff strategy as regular uploads. |
+
+```dotenv
+ENABLE_FACTORY_RESET=true
+```
+
+### API Endpoints
+
+When `ENABLE_FACTORY_RESET=true`, two admin-only API endpoints are available:
+
+- `POST /api/admin/system-reset/full` — body: `{"confirmation": "DELETE"}`
+- `POST /api/admin/system-reset/reimport` — body: `{"confirmation": "REIMPORT"}`
+- `GET  /api/admin/system-reset/status` — returns current feature-flag state
+
+### What Gets Deleted
+
+| Deleted | Preserved |
+|---------|-----------|
+| All document records (`files` table) | Application settings (`application_settings` table) |
+| Processing logs and steps | User accounts and profiles |
+| Audit logs | Subscription plans |
+| Backup records | Pipelines and scheduled jobs |
+| Original, processed, and temporary files | The workdir directory itself |
+| Watch-folder caches and ingestion state | OAuth and integration configuration |
+
 ## Configuration File Location
 
 The `.env` file should be placed at the root of the project directory. When using Docker Compose, you can reference it with the `env_file` directive in your `docker-compose.yml`.

docs/CredentialRotationGuide.md

@@ -11,7 +11,7 @@ Credentials fall into two categories:
 | Category | Examples |
 |---|---|
 | **API keys** | OpenAI API key, Azure AI key, Paperless-ngx API token, AWS access keys |
-| **OAuth tokens / secrets** | Dropbox, Google Drive, OneDrive, Authentik client secrets and refresh tokens |
+| **OAuth tokens / secrets** | Dropbox, Google Drive, OneDrive, SharePoint, Authentik client secrets and refresh tokens |
 | **Passwords** | Admin password, Nextcloud, Email (SMTP), IMAP, FTP, SFTP, WebDAV |
 | **Private keys** | SFTP private key and passphrase |
 
@@ -119,6 +119,15 @@ For service-account credentials (`google_drive_credentials_json`):
 4. Re-authorize via the OAuth flow to get a fresh `onedrive_refresh_token`.
 5. Delete the old client secret in Azure.
 
+### SharePoint (Microsoft OAuth)
+
+1. SharePoint uses the same Azure AD app registration as OneDrive.
+2. In **Azure App Registrations**, navigate to **Certificates & secrets** for your app.
+3. Add a new client secret.
+4. Update `sharepoint_client_secret` in DocuElevate.
+5. Re-authorize via the OAuth flow to get a fresh `sharepoint_refresh_token`.
+6. Delete the old client secret in Azure.
+
 ### Authentik (OIDC)
 
 1. In your Authentik admin panel, navigate to the DocuElevate application and regenerate the client secret.

docs/DatabaseConfiguration.md

@@ -287,6 +287,27 @@ alembic revision --autogenerate -m "describe your change"
 
 Review the generated file in `migrations/versions/` before applying it.
 
+> **Tip:** For detailed guidance on naming conventions, idempotent patterns, parallel-branch workflows, and resolving merge conflicts, see the [Migration Workflow Guide](MigrationWorkflow.md).
+
+### Validating the Migration Chain
+
+A CI check and pre-commit hook validate that the migration chain has no broken
+references, duplicate revisions, or diverged heads.  Run the check locally:
+
+```bash
+python scripts/check_alembic_migrations.py
+python scripts/check_alembic_migrations.py --verbose   # extra detail
+```
+
+If you see **"Multiple migration heads detected"**, two branches added
+migrations from the same parent.  Create a merge migration:
+
+```bash
+alembic merge heads -m "merge_parallel_branches"
+```
+
+For a complete walk-through, see the [Migration Workflow Guide](MigrationWorkflow.md).
+
 ### Automating Migrations in Docker Compose
 
 Add a short-lived `migrate` service that runs before the API and Worker:

docs/DeploymentGuide.md

@@ -19,7 +19,7 @@ This guide covers all supported deployment methods for DocuElevate.
 - Access to required external services (if configured):
   - AI provider API key (OpenAI, Anthropic, Gemini, or other configured provider)
   - Azure Document Intelligence
-  - Dropbox, Google Drive, OneDrive, S3, or other storage APIs
+  - Dropbox, Google Drive, OneDrive, SharePoint, S3, or other storage APIs
   - SMTP / IMAP server (for email processing)
   - Notification services (Discord, Telegram, etc.)
 

docs/InternationalizationGuide.md

@@ -1,67 +1,97 @@
 # Internationalization (i18n) & Localization (l10n) Guide
 
-DocuElevate supports **49 languages** for its web UI, with automatic browser
+DocuElevate supports **77 languages** for its web UI, with automatic browser
 language detection, user-preference persistence, and an AI-powered fallback
 translator for strings that haven't been manually translated yet.
 
 ## Supported Languages
 
-| Code  | Language         | Native Name        | Flag | Priority |
-|-------|------------------|--------------------|------|----------|
-| `en`  | English          | English            | 🇬🇧   | Tier 1   |
-| `de`  | German           | Deutsch            | 🇩🇪   | Tier 1   |
-| `fr`  | French           | Français           | 🇫🇷   | Tier 1   |
-| `es`  | Spanish          | Español            | 🇪🇸   | Tier 1   |
-| `it`  | Italian          | Italiano           | 🇮🇹   | Tier 1   |
-| `pt`  | Portuguese       | Português          | 🇵🇹   | Tier 1   |
-| `nl`  | Dutch            | Nederlands         | 🇳🇱   | Tier 2   |
-| `nb`  | Norwegian Bokmål | Norsk bokmål       | 🇳🇴   | Tier 2   |
-| `no`  | Norwegian        | Norsk              | 🇳🇴   | Tier 2   |
-| `da`  | Danish           | Dansk              | 🇩🇰   | Tier 2   |
-| `sv`  | Swedish          | Svenska            | 🇸🇪   | Tier 2   |
-| `fi`  | Finnish          | Suomi              | 🇫🇮   | Tier 2   |
-| `is`  | Icelandic        | Íslenska           | 🇮🇸   | Tier 2   |
-| `ga`  | Irish            | Gaeilge            | 🇮🇪   | Tier 2   |
-| `lb`  | Luxembourgish    | Lëtzebuergesch     | 🇱🇺   | Tier 2   |
-| `ca`  | Catalan          | Català             | 🏴    | Tier 2   |
-| `cy`  | Welsh            | Cymraeg            | 🏴󠁧󠁢󠁷󠁬󠁳󠁿   | Tier 2   |
-| `fy`  | Frisian          | Frysk              | 🇳🇱   | Tier 2   |
-| `gl`  | Galician         | Galego             | 🇪🇸   | Tier 2   |
-| `li`  | Limburgish       | Limburgs           | 🇳🇱   | Tier 2   |
-| `vls` | West Flemish     | West-Vlams         | 🇧🇪   | Tier 2   |
-| `nds` | Low German       | Plattdüütsch       | 🇩🇪   | Tier 2   |
-| `pl`  | Polish           | Polski             | 🇵🇱   | Tier 3   |
-| `cs`  | Czech            | Čeština            | 🇨🇿   | Tier 3   |
-| `sk`  | Slovak           | Slovenčina         | 🇸🇰   | Tier 3   |
-| `hu`  | Hungarian        | Magyar             | 🇭🇺   | Tier 3   |
-| `sl`  | Slovenian        | Slovenščina        | 🇸🇮   | Tier 3   |
-| `hr`  | Croatian         | Hrvatski           | 🇭🇷   | Tier 3   |
-| `ro`  | Romanian         | Română             | 🇷🇴   | Tier 3   |
-| `bg`  | Bulgarian        | Български          | 🇧🇬   | Tier 3   |
-| `el`  | Greek            | Ελληνικά           | 🇬🇷   | Tier 3   |
-| `et`  | Estonian         | Eesti              | 🇪🇪   | Tier 3   |
-| `lv`  | Latvian          | Latviešu           | 🇱🇻   | Tier 3   |
-| `lt`  | Lithuanian       | Lietuvių           | 🇱🇹   | Tier 3   |
-| `sr`  | Serbian          | Српски             | 🇷🇸   | Tier 3   |
-| `tr`  | Turkish          | Türkçe             | 🇹🇷   | Tier 4   |
-| `uk`  | Ukrainian        | Українська         | 🇺🇦   | Tier 4   |
-| `ru`  | Russian          | Русский            | 🇷🇺   | Tier 4   |
-| `he`  | Hebrew           | עברית              | 🇮🇱   | Tier 4   |
-| `ar`  | Arabic           | العربية            | 🇸🇦   | Tier 4   |
-| `fa`  | Persian          | فارسی              | 🇮🇷   | Tier 4   |
-| `af`  | Afrikaans        | Afrikaans          | 🇿🇦   | Tier 4   |
-| `zh`  | Chinese          | 中文               | 🇨🇳   | Tier 5   |
-| `ja`  | Japanese         | 日本語             | 🇯🇵   | Tier 5   |
-| `ko`  | Korean           | 한국어             | 🇰🇷   | Tier 5   |
-| `vi`  | Vietnamese       | Tiếng Việt         | 🇻🇳   | Tier 5   |
-| `pa`  | Punjabi          | ਪੰਜਾਬੀ             | 🇮🇳   | Tier 5   |
-| `kn`  | Kannada          | ಕನ್ನಡ              | 🇮🇳   | Tier 5   |
-| `eo`  | Esperanto        | Esperanto          | 🌍    | Tier 6   |
+| Code    | Language           | Native Name        | Flag | Priority |
+|---------|--------------------|--------------------|------|----------|
+| `en`    | English            | English            | 🇬🇧   | Tier 1   |
+| `de`    | German             | Deutsch            | 🇩🇪   | Tier 1   |
+| `fr`    | French             | Français           | 🇫🇷   | Tier 1   |
+| `es`    | Spanish            | Español            | 🇪🇸   | Tier 1   |
+| `it`    | Italian            | Italiano           | 🇮🇹   | Tier 1   |
+| `pt`    | Portuguese         | Português          | 🇵🇹   | Tier 1   |
+| `nl`    | Dutch              | Nederlands         | 🇳🇱   | Tier 2   |
+| `nb`    | Norwegian Bokmål   | Norsk bokmål       | 🇳🇴   | Tier 2   |
+| `no`    | Norwegian          | Norsk              | 🇳🇴   | Tier 2   |
+| `da`    | Danish             | Dansk              | 🇩🇰   | Tier 2   |
+| `sv`    | Swedish            | Svenska            | 🇸🇪   | Tier 2   |
+| `fi`    | Finnish            | Suomi              | 🇫🇮   | Tier 2   |
+| `is`    | Icelandic          | Íslenska           | 🇮🇸   | Tier 2   |
+| `ga`    | Irish              | Gaeilge            | 🇮🇪   | Tier 2   |
+| `lb`    | Luxembourgish      | Lëtzebuergesch     | 🇱🇺   | Tier 2   |
+| `ca`    | Catalan            | Català             | 🏴    | Tier 2   |
+| `cy`    | Welsh              | Cymraeg            | 🏴󠁧󠁢󠁷󠁬󠁳󠁿   | Tier 2   |
+| `fy`    | Western Frisian    | Frysk              | 🇳🇱   | Tier 2   |
+| `gl`    | Galician           | Galego             | 🇪🇸   | Tier 2   |
+| `li`    | Limburgish         | Limburgs           | 🇳🇱   | Tier 2   |
+| `vls`   | Flemish            | West-Vlams         | 🇧🇪   | Tier 2   |
+| `nds`   | Low German         | Plattdüütsch       | 🇩🇪   | Tier 2   |
+| `pl`    | Polish             | Polski             | 🇵🇱   | Tier 3   |
+| `cs`    | Czech              | Čeština            | 🇨🇿   | Tier 3   |
+| `sk`    | Slovak             | Slovenčina         | 🇸🇰   | Tier 3   |
+| `hu`    | Hungarian          | Magyar             | 🇭🇺   | Tier 3   |
+| `sl`    | Slovenian          | Slovenščina        | 🇸🇮   | Tier 3   |
+| `hr`    | Croatian           | Hrvatski           | 🇭🇷   | Tier 3   |
+| `ro`    | Romanian           | Română             | 🇷🇴   | Tier 3   |
+| `bg`    | Bulgarian          | Български          | 🇧🇬   | Tier 3   |
+| `el`    | Greek              | Ελληνικά           | 🇬🇷   | Tier 3   |
+| `et`    | Estonian           | Eesti              | 🇪🇪   | Tier 3   |
+| `lv`    | Latvian            | Latviešu           | 🇱🇻   | Tier 3   |
+| `lt`    | Lithuanian         | Lietuvių           | 🇱🇹   | Tier 3   |
+| `sr`    | Serbian            | Српски             | 🇷🇸   | Tier 3   |
+| `tr`    | Turkish            | Türkçe             | 🇹🇷   | Tier 4   |
+| `uk`    | Ukrainian          | Українська         | 🇺🇦   | Tier 4   |
+| `he`    | Hebrew             | עברית              | 🇮🇱   | Tier 4   |
+| `ar`    | Arabic             | العربية            | 🇸🇦   | Tier 4   |
+| `fa`    | Persian            | فارسی              | 🇮🇷   | Tier 4   |
+| `af`    | Afrikaans          | Afrikaans          | 🇿🇦   | Tier 4   |
+| `zh`    | Chinese            | 中文               | 🇨🇳   | Tier 5   |
+| `zh-TW` | Traditional Chinese | 繁體中文           | 🇹🇼   | Tier 5   |
+| `ja`    | Japanese           | 日本語             | 🇯🇵   | Tier 5   |
+| `ko`    | Korean             | 한국어             | 🇰🇷   | Tier 5   |
+| `vi`    | Vietnamese         | Tiếng Việt         | 🇻🇳   | Tier 5   |
+| `pa`    | Punjabi            | ਪੰਜਾਬੀ             | 🇮🇳   | Tier 5   |
+| `kn`    | Kannada            | ಕನ್ನಡ              | 🇮🇳   | Tier 5   |
+| `hi`    | Hindi              | हिन्दी             | 🇮🇳   | Tier 5   |
+| `bn`    | Bengali            | বাংলা              | 🇧🇩   | Tier 5   |
+| `gu`    | Gujarati           | ગુજરાતી            | 🇮🇳   | Tier 5   |
+| `ml`    | Malayalam          | മലയാളം             | 🇮🇳   | Tier 5   |
+| `mr`    | Marathi            | मराठी              | 🇮🇳   | Tier 5   |
+| `ta`    | Tamil              | தமிழ்              | 🇮🇳   | Tier 5   |
+| `te`    | Telugu             | తెలుగు             | 🇮🇳   | Tier 5   |
+| `ur`    | Urdu               | اردو               | 🇵🇰   | Tier 5   |
+| `si`    | Sinhala            | සිංහල              | 🇱🇰   | Tier 5   |
+| `ne`    | Nepali             | नेपाली             | 🇳🇵   | Tier 5   |
+| `th`    | Thai               | ไทย                | 🇹🇭   | Tier 5   |
+| `km`    | Khmer              | ខ្មែរ              | 🇰🇭   | Tier 5   |
+| `id`    | Indonesian         | Bahasa Indonesia   | 🇮🇩   | Tier 5   |
+| `ms`    | Malay              | Bahasa Melayu      | 🇲🇾   | Tier 5   |
+| `jv`    | Javanese           | Basa Jawa          | 🇮🇩   | Tier 5   |
+| `tl`    | Tagalog            | Filipino           | 🇵🇭   | Tier 5   |
+| `mn`    | Mongolian          | Монгол             | 🇲🇳   | Tier 5   |
+| `kk`    | Kazakh             | Қазақ тілі         | 🇰🇿   | Tier 5   |
+| `uz`    | Uzbek              | Oʻzbekcha          | 🇺🇿   | Tier 5   |
+| `az`    | Azerbaijani        | Azərbaycan dili    | 🇦🇿   | Tier 5   |
+| `hy`    | Armenian           | Հայերեն            | 🇦🇲   | Tier 5   |
+| `ka`    | Georgian           | ქართული            | 🇬🇪   | Tier 5   |
+| `sw`    | Swahili            | Kiswahili          | 🇰🇪   | Tier 6   |
+| `am`    | Amharic            | አማርኛ               | 🇪🇹   | Tier 6   |
+| `ha`    | Hausa              | Hausa              | 🇳🇬   | Tier 6   |
+| `yo`    | Yoruba             | Yorùbá             | 🇳🇬   | Tier 6   |
+| `ig`    | Igbo               | Igbo               | 🇳🇬   | Tier 6   |
+| `zu`    | Zulu               | isiZulu            | 🇿🇦   | Tier 6   |
+| `eo`    | Esperanto          | Esperanto          | 🌍    | Tier 7   |
 
 > **Tier 1** languages (major European) have complete, manually-reviewed
 > translations. **Tier 2–3** languages have complete translations but may
-> receive less frequent updates. **Tier 4–5** cover Non-EU European, Middle
-> Eastern, and Asian languages. **Tier 6** covers constructed languages.
+> receive less frequent updates. **Tier 4** covers Non-EU European, Middle
+> Eastern, and South African (Afrikaans) languages. **Tier 5** covers Asian
+> and Central Asian languages. **Tier 6** covers African languages. **Tier 7**
+> covers constructed languages.
 
 ## How Language Is Detected
 
@@ -222,8 +252,11 @@ format_number(1234.56, "en")                # → "1,234.56"
 ### Adding a New Translation Key
 
 1. Add the key and English text to `frontend/translations/en.json`
-2. Add translations for all other languages in their respective files
-3. Use `{{ _("your.new.key") }}` in templates
+2. Use `{{ _("your.new.key") }}` in templates or `translate("your.new.key", locale)` in Python
+
+That's it. An external automation script picks up new keys in `en.json` and propagates
+translations to all other language files. You never need to touch the non-English JSON
+files manually — the translate-and-sync pipeline takes care of it.
 
 ### AI Fallback Translation
 

docs/MigrationWorkflow.md

@@ -0,0 +1,360 @@
+# Migration Workflow
+
+This guide explains how to create, test, and merge Alembic database migrations in DocuElevate — especially when **multiple feature branches** add migrations in parallel.
+
+## Table of Contents
+
+- [Quick Reference](#quick-reference)
+- [Creating a New Migration](#creating-a-new-migration)
+- [Migration Naming Convention](#migration-naming-convention)
+- [Idempotent Migration Patterns](#idempotent-migration-patterns)
+- [Parallel Branch Development](#parallel-branch-development)
+- [Resolving Migration Conflicts](#resolving-migration-conflicts)
+- [CI Validation](#ci-validation)
+- [Pre-commit Hook](#pre-commit-hook)
+- [Troubleshooting](#troubleshooting)
+
+---
+
+## Quick Reference
+
+```bash
+# Create a new migration after editing app/models.py
+alembic revision --autogenerate -m "add_foobar_column"
+
+# Apply all pending migrations
+alembic upgrade head
+
+# Check current database version
+alembic current
+
+# View migration history
+alembic history --verbose
+
+# Detect multiple heads (diverged branches)
+alembic heads
+
+# Create a merge migration to resolve multiple heads
+alembic merge heads -m "merge_parallel_branches"
+
+# Validate migration chain integrity (CI script)
+python scripts/check_alembic_migrations.py
+python scripts/check_alembic_migrations.py --verbose
+```
+
+---
+
+## Creating a New Migration
+
+1. **Edit `app/models.py`** — add or modify SQLAlchemy model classes.
+
+2. **Generate the migration** from the repo root.  Use `--rev-id` to set the
+   revision identifier directly (avoids renaming afterwards):
+
+   ```bash
+   alembic revision --autogenerate --rev-id 037_add_my_new_table -m "add my new table"
+   ```
+
+   This creates `migrations/versions/037_add_my_new_table_add_my_new_table.py`
+   with `revision = "037_add_my_new_table"`.  Rename the file to match:
+
+   ```bash
+   mv migrations/versions/037_add_my_new_table_add_my_new_table.py \
+      migrations/versions/037_add_my_new_table.py
+   ```
+
+   Alternatively, generate with the default hash and then rename:
+
+   ```bash
+   alembic revision --autogenerate -m "add_my_new_table"
+   # Rename: mv migrations/versions/<hash>_add_my_new_table.py migrations/versions/037_add_my_new_table.py
+   # Update revision inside the file to match the filename stem.
+   ```
+
+   Alembic uses the `migrations/script.py.mako` template to generate the file.  The template includes inline comments about idempotent patterns — read them.
+
+3. **Review the generated code** — autogenerate is helpful but not perfect.  Check:
+   - Are new tables and columns detected correctly?
+   - Does the `downgrade()` reverse all changes?
+   - Are SQLite-incompatible operations wrapped in `batch_alter_table()`?
+
+4. **Test the migration** against a fresh database:
+
+   ```bash
+   # Apply
+   alembic upgrade head
+
+   # Rollback
+   alembic downgrade -1
+
+   # Re-apply
+   alembic upgrade head
+   ```
+
+5. **Run the chain validation**:
+
+   ```bash
+   python scripts/check_alembic_migrations.py
+   ```
+
+---
+
+## Migration Naming Convention
+
+All migration files follow a **sequential numeric prefix** scheme:
+
+```
+NNN_short_description.py
+```
+
+| Component | Rule |
+|-----------|------|
+| `NNN` | Three-digit zero-padded number, incrementing from the previous migration |
+| `short_description` | Lowercase snake_case summary of the change |
+
+The **`revision`** variable inside the file **must match the filename stem** exactly:
+
+```python
+# File: migrations/versions/037_add_classification_rules.py
+revision: str = "037_add_classification_rules"
+down_revision: Union[str, None] = "036_add_document_translation_fields"
+```
+
+The CI check (`scripts/check_alembic_migrations.py`) enforces this consistency.
+
+---
+
+## Idempotent Migration Patterns
+
+Migrations should be **idempotent** — safe to run even if the change already exists.  This is critical for SQLite compatibility and for recovering from partial failures.
+
+### Add a Column (only if missing)
+
+```python
+def upgrade() -> None:
+    conn = op.get_bind()
+    inspector = sa.inspect(conn)
+
+    if "my_table" in inspector.get_table_names():
+        existing = {c["name"] for c in inspector.get_columns("my_table")}
+        if "new_col" not in existing:
+            with op.batch_alter_table("my_table") as batch_op:
+                batch_op.add_column(sa.Column("new_col", sa.String(128), nullable=True))
+```
+
+### Create a Table (only if missing)
+
+```python
+def upgrade() -> None:
+    conn = op.get_bind()
+    inspector = sa.inspect(conn)
+
+    if "new_table" not in inspector.get_table_names():
+        op.create_table(
+            "new_table",
+            sa.Column("id", sa.Integer(), primary_key=True),
+            sa.Column("name", sa.String(255), nullable=False),
+        )
+```
+
+### Drop a Column (only if present)
+
+```python
+def downgrade() -> None:
+    conn = op.get_bind()
+    inspector = sa.inspect(conn)
+
+    if "my_table" in inspector.get_table_names():
+        existing = {c["name"] for c in inspector.get_columns("my_table")}
+        if "new_col" in existing:
+            with op.batch_alter_table("my_table") as batch_op:
+                batch_op.drop_column("new_col")
+```
+
+### Use `batch_alter_table` for SQLite
+
+SQLite does not support `ALTER TABLE DROP COLUMN` or `ALTER TABLE RENAME COLUMN` natively.  Alembic's `batch_alter_table` context manager works around this by recreating the table:
+
+```python
+with op.batch_alter_table("users") as batch_op:
+    batch_op.add_column(sa.Column("phone", sa.String(20), nullable=True))
+    batch_op.drop_column("fax")
+```
+
+---
+
+## Parallel Branch Development
+
+When two feature branches both add migrations from the same parent, the migration chain **diverges** into multiple heads.  This is normal and expected — Alembic supports it — but the heads must be merged before the code reaches `main`.
+
+### Example
+
+```
+main:   001 → 002 → 003
+                         ↘ Branch A: 004_add_widgets
+                         ↘ Branch B: 004_add_gadgets   ← two heads!
+```
+
+### How to Avoid Conflicts
+
+1. **Coordinate** — if two developers are both adding migrations, assign different sequence numbers (e.g., `037_` and `038_`).  Even if both depend on `036_`, different numbers prevent filename collisions.
+
+2. **Rebase early** — before opening a PR, rebase your branch onto the latest `main`:
+
+   ```bash
+   git fetch origin main
+   git rebase origin/main
+   ```
+
+   If `main` now has a new migration `037_*`, renumber yours to `038_*` and update `down_revision` to point at `037_*`.
+
+3. **Check for multiple heads** locally:
+
+   ```bash
+   python scripts/check_alembic_migrations.py
+   # or
+   alembic heads
+   ```
+
+---
+
+## Resolving Migration Conflicts
+
+If your PR's CI check reports **"Multiple migration heads detected"**, follow these steps:
+
+### Step 1 — Update Your Branch
+
+```bash
+git fetch origin main
+git merge origin/main
+# or
+git rebase origin/main
+```
+
+### Step 2 — Check Heads
+
+```bash
+python scripts/check_alembic_migrations.py --verbose
+```
+
+The output lists the conflicting heads.
+
+### Step 3 — Create a Merge Migration
+
+```bash
+alembic merge heads -m "merge_parallel_branches"
+```
+
+This generates a new migration with **two parents** (a merge point):
+
+```python
+down_revision = ("037_add_widgets", "037_add_gadgets")
+```
+
+### Step 4 — Rename and Validate
+
+Rename the merge migration to the next sequence number:
+
+```bash
+mv migrations/versions/<hash>_merge_parallel_branches.py \
+   migrations/versions/038_merge_parallel_branches.py
+```
+
+Update the `revision` inside to match, then validate:
+
+```bash
+python scripts/check_alembic_migrations.py
+```
+
+### Step 5 — Test
+
+```bash
+alembic upgrade head
+alembic downgrade -1
+alembic upgrade head
+```
+
+---
+
+## CI Validation
+
+The CI pipeline (`.github/workflows/ci.yml`) includes a **migration-chain** job that runs:
+
+```bash
+python scripts/check_alembic_migrations.py
+```
+
+This script checks for:
+
+| Check | Description |
+|-------|-------------|
+| Multiple heads | Diverged migration chains that need a merge migration |
+| Broken references | A `down_revision` that points to a non-existent revision |
+| Duplicate revisions | Two files declaring the same `revision` identifier |
+| Filename mismatches | The `revision` variable doesn't match the filename stem |
+
+The job runs in Stage 1 (fast-fail gates) alongside lint checks.  If it fails, the build is blocked until the migration chain is fixed.
+
+---
+
+## Pre-commit Hook
+
+A local pre-commit hook is configured in `.pre-commit-config.yaml` that runs the same check whenever you commit a change to `migrations/versions/`:
+
+```yaml
+- repo: local
+  hooks:
+    - id: check-alembic-migrations
+      name: Check Alembic migration chain
+      entry: python scripts/check_alembic_migrations.py
+      language: python
+      pass_filenames: false
+      files: ^migrations/versions/.*\.py$
+```
+
+Install the hook:
+
+```bash
+pip install pre-commit
+pre-commit install
+```
+
+---
+
+## Troubleshooting
+
+### "Multiple migration heads detected"
+
+See [Resolving Migration Conflicts](#resolving-migration-conflicts) above.
+
+### "Broken chain: revision X references down_revision Y which does not exist"
+
+You removed or renamed a migration that another migration depends on.  Either restore the missing file or update the dependent migration's `down_revision`.
+
+### "Filename mismatch: file declares revision=X but filename stem is Y"
+
+The `revision` string inside the Python file must match the filename (without `.py`).  Rename the file or update the variable.
+
+### "relation already exists" when running `alembic upgrade head`
+
+The database has a table that a pending migration tries to create.  Stamp the current state:
+
+```bash
+alembic stamp head
+```
+
+### Autogenerate doesn't detect my changes
+
+Ensure all models are imported in `migrations/env.py`.  The `from app.models import ...` block at the top must include your new model class.
+
+### SQLite "no such column" after downgrade
+
+SQLite has limited `ALTER TABLE` support.  Always use `op.batch_alter_table()` for column operations on existing tables.
+
+---
+
+## Further Reading
+
+- [Alembic Tutorial](https://alembic.sqlalchemy.org/en/latest/tutorial.html)
+- [Alembic Branch / Merge](https://alembic.sqlalchemy.org/en/latest/branches.html)
+- [Database Configuration Guide](DatabaseConfiguration.md)

docs/MobileApp.md

@@ -8,6 +8,7 @@ DocuElevate includes a native mobile application for iOS and Android built with
 |---------|-----|---------|
 | SSO login (OAuth2) | ✅ | ✅ |
 | Local / basic auth login | ✅ | ✅ |
+| QR code login (scan from web) | ✅ | ✅ |
 | Auto-generated API token | ✅ | ✅ |
 | Camera capture → upload | ✅ | ✅ |
 | File picker upload | ✅ | ✅ |
@@ -20,7 +21,7 @@ DocuElevate includes a native mobile application for iOS and Android built with
 
 ### Prerequisites
 
-- Node.js 18 or later
+- Node.js 20.19.4 or later (use [nvm](https://github.com/nvm-sh/nvm): `nvm install` inside `mobile/` reads `.nvmrc` automatically)
 - [Expo CLI](https://docs.expo.dev/get-started/installation/): `npm install -g @expo/cli`
 - [Expo Go](https://expo.dev/client) app on your iOS or Android device (for development)
 - A running DocuElevate server reachable from your device
@@ -53,8 +54,38 @@ eas build --platform ios
 eas build --platform android
 ```
 
+> **Note:** The mobile app uses `expo-build-properties` with `buildReactNativeFromSource: true` for iOS builds. This is required for Expo SDK 54 (React Native 0.81) compatibility — some native modules still use legacy bridge APIs (`RCTBridge`, `RCTViewManager`, etc.) that are no longer included in the default precompiled XCFrameworks. Building React Native from source makes these headers available, at the cost of slightly longer iOS build times.
+
 See the [EAS Build documentation](https://docs.expo.dev/build/introduction/) for full setup instructions.
 
+## Automated CI/CD
+
+An **EAS Cloud Workflow** (`mobile/.eas/workflows/create-builds.yml`) automates production builds and iOS submission:
+
+- **Path filtering:** The workflow only triggers on pushes to `main` that include changes inside the `mobile/` directory.  Backend-only or documentation-only changes do not trigger a mobile build.
+- **Build:** Both iOS and Android production builds run in parallel on EAS Build.
+- **Auto-submit (iOS):** After a successful iOS build, the workflow automatically submits the binary to **App Store Connect** using the credentials configured in `eas.json` (`submit.production.ios`).  The build then appears in **TestFlight** for internal testing and can be promoted to the App Store from App Store Connect.
+
+> **Prerequisite:** An App Store Connect API Key must be configured in EAS for non-interactive submission.  See [Troubleshooting → "Session expired"](#session-expired-local-session-during-ios-build) below for setup instructions.
+
+### Version Management
+
+Build numbers (iOS `buildNumber` / Android `versionCode`) are managed **remotely** by EAS.  The `eas.json` configuration uses:
+
+```json
+{
+  "cli": { "appVersionSource": "remote" },
+  "build": { "production": { "autoIncrement": true } }
+}
+```
+
+- **`appVersionSource: "remote"`** — EAS stores the current build number on its servers instead of reading it from `app.json`.  This ensures every CI build gets a unique, ever-increasing number without needing to commit version bumps back to the repository.
+- **`autoIncrement: true`** — EAS automatically increments the build number before each production build.
+
+The `ios.buildNumber` and `android.versionCode` values in `app.json` serve as the **initial seed** when the remote version is first created; after that they are informational only.  Do not rely on them for the actual version submitted to the stores.
+
+> **Tip:** To check or manually set the remote version, use `eas build:version:get` and `eas build:version:set`.
+
 ## Authentication
 
 ### SSO Login Flow
@@ -62,11 +93,37 @@ See the [EAS Build documentation](https://docs.expo.dev/build/introduction/) for
 The mobile app uses the server's existing OAuth2/SSO setup:
 
 1. User enters the DocuElevate server URL on the login screen.
-2. The app opens `<server>/login?mobile=1&redirect_uri=docuelevate://callback` in the **system browser** (Safari / Chrome).
-3. The user authenticates via SSO or local credentials.
-4. The server redirects back to `docuelevate://callback`.
-5. The app calls `POST /api/mobile/generate-token` to exchange the session for a **long-lived API token**.
-6. The token is stored securely in the device's keychain (`expo-secure-store`).
+2. The app opens `<server>/login?mobile=1&redirect_uri=docuelevate://callback` in the **system browser** (Safari / Chrome Custom Tabs).
+3. The server stores `docuelevate://callback` in the browser session and presents the login page.
+4. The user authenticates via SSO or local credentials.
+5. After successful authentication the server mints a long-lived API token and redirects the browser to `docuelevate://callback?token=<token>`.
+6. `WebBrowser.openAuthSessionAsync` intercepts the `docuelevate://` deep link and returns the URL to the app.
+7. The app extracts the token from the URL and stores it securely in the device's keychain (`expo-secure-store`).
+
+> **Security note:** The `redirect_uri` is validated server-side; only URIs with the `docuelevate://` custom scheme (production) or the `exp://` scheme (Expo Go development) are accepted, preventing open-redirect attacks.
+
+### Testing in Expo Go
+
+When developing with **Expo Go** the app does not have the `docuelevate://` custom URL scheme registered.  The auth flow adapts automatically:
+
+1. `Linking.createURL('callback')` returns an `exp://` URI pointing at the local dev server (e.g. `exp://192.168.1.5:8081/--/callback`).
+2. This URI is sent to the server as `redirect_uri`; the server accepts it alongside the production `docuelevate://` scheme.
+3. After successful authentication the server redirects back to the `exp://` URI.
+4. `WebBrowser.openAuthSessionAsync` intercepts the deep link and the Expo Go app receives the token.
+
+No extra configuration is needed — just run `npx expo start` and scan the QR code with the **Expo Go** app.
+
+### QR Code Login Flow
+
+As an alternative to SSO, users can log in by scanning a QR code displayed in the web UI:
+
+1. The authenticated web user navigates to **Profile → Security & Sessions → Log in on mobile via QR code**.
+2. A QR code is displayed containing a deep link: `docuelevate://qr-login?token=<challenge_token>&server=<server_url>`.
+3. In the mobile app, the user taps **Scan QR Code to Login**, which opens the device camera.
+4. The app scans the QR code, extracts both the server URL and the challenge token, and calls `POST /api/qr-auth/claim`.
+5. An API token is issued and stored securely — no need to enter the server URL manually.
+
+> **Note:** The QR code already contains the server URL, so users do not need to type it in when using QR login.
 
 ### Auto-generated Mobile Token
 
@@ -110,10 +167,17 @@ curl -X DELETE -H "Authorization: Bearer <token>" https://your-server/api/mobile
 3. Point the camera at the document and take a photo.
 4. The image is immediately uploaded and queued for processing.
 
+### Photo Library
+
+1. Open the **Upload** tab.
+2. Tap **Photos**.
+3. Select an existing photo from the device's photo library.
+4. The image is uploaded and queued for processing.
+
 ### File Picker
 
 1. Open the **Upload** tab.
-2. Tap **File Picker**.
+2. Tap **Files**.
 3. Browse to and select one or more files (PDF, DOCX, images, etc.).
 4. Files are uploaded and queued for processing.
 
@@ -124,10 +188,33 @@ The app registers itself as a share target so any file can be sent directly to D
 1. Open a file in Files, Mail, Safari, or any other app.
 2. Tap the **Share** button (iOS) or **Share** (Android).
 3. Find and tap **DocuElevate** in the share sheet.
-4. The file is immediately uploaded.
+4. The file is immediately uploaded and queued for processing.
 
 > **Note:** The app must be installed on the device for it to appear in the share sheet.
 
+#### iOS implementation
+
+`app.json` declares `CFBundleDocumentTypes` (with `LSHandlerRank: Alternate`) inside the iOS `infoPlist`.  This tells iOS that DocuElevate can open common document types, making it visible in the share sheet without overriding system defaults.  When the user selects DocuElevate, iOS opens the app with a URL via `application:openURL:options:`.
+
+The URL may arrive as a standard `file://` path **or** under the app's custom `docuelevate://` scheme (e.g. `docuelevate://private/var/mobile/Library/…/file.pdf`).  The root layout detects the custom-scheme form and rewrites it to a `file://` URL before forwarding it to the Upload screen through `ShareContext`.
+
+#### Android implementation
+
+`app.json` declares `ACTION_SEND` and `ACTION_SEND_MULTIPLE` intent filters for `mimeType: "*/*"` in the `android.intentFilters` section.  Incoming content URIs are received the same way as on iOS.
+
+#### Upload status polling
+
+After a file is uploaded the app polls `/api/files?search=<filename>` every 5 seconds to find the corresponding `FileRecord`, then polls `/api/files/{id}` to track the processing status in real time.  Polling stops automatically once the status reaches a terminal state (`completed`, `failed`, or `duplicate`).
+
+#### Retrying failed uploads
+
+If a file upload fails (e.g. due to network issues or a server error), the failed item stays visible in the upload list with an error message and a **"Tap to retry"** hint.  Users can retry the upload in two ways:
+
+- **Tap** the failed item to immediately retry the upload.
+- **Long-press** the failed item to see a confirmation dialog with a **Retry** option.
+
+The retry re-uses the original file URI so no re-selection is needed.
+
 ## Mobile API Endpoints
 
 The backend exposes a dedicated `/api/mobile/` namespace:
@@ -205,19 +292,34 @@ If you wish to use **direct FCM/APNs** without Expo's relay, replace the `send_e
 
 ```
 mobile/
-├── App.tsx                      # Root component
+├── App.tsx                      # Root component (legacy, not used at runtime)
+├── app/                         # Expo Router file-based routes
+│   ├── _layout.tsx              # Root layout (AuthGuard + providers)
+│   ├── index.tsx                # Root redirect → /(auth)/
+│   ├── (auth)/                  # Unauthenticated route group
+│   │   ├── _layout.tsx          # Stack navigator (headerless)
+│   │   ├── index.tsx            # Welcome screen
+│   │   ├── login.tsx            # Login screen
+│   │   └── qr-scanner.tsx       # QR code scanner screen
+│   └── (tabs)/                  # Authenticated route group
+│       ├── _layout.tsx          # Tab navigator
+│       ├── index.tsx            # Upload screen (default tab)
+│       ├── files.tsx            # Files screen
+│       └── profile.tsx          # Profile screen
 ├── app.json                     # Expo/EAS configuration
 ├── eas.json                     # EAS Build profiles
 ├── package.json
 ├── tsconfig.json
 └── src/
     ├── context/
-    │   └── AuthContext.tsx      # Auth state + SSO login flow
+    │   ├── AuthContext.tsx      # Auth state + SSO login flow
+    │   └── ShareContext.tsx     # Shared-file queue (iOS Share Sheet / Android Intent)
     ├── hooks/
     │   └── usePushNotifications.ts  # Push token registration
     ├── screens/
-    │   ├── LoginScreen.tsx      # Server URL + SSO button
-    │   ├── UploadScreen.tsx     # Camera capture + file picker
+    │   ├── LoginScreen.tsx      # Server URL + SSO button + QR code scanner
+    │   ├── QRScannerScreen.tsx  # Camera-based QR code scanner for login
+    │   ├── UploadScreen.tsx     # Camera capture + photo library + file picker
     │   ├── FilesScreen.tsx      # Processed document list
     │   └── ProfileScreen.tsx    # User profile + sign out
     └── services/
@@ -226,6 +328,62 @@ mobile/
 
 ## Troubleshooting
 
+### App shows "Hello World" / default Expo page after update
+
+If the iOS or Android app shows a generic "Hello World – This is the first page of your app" screen instead of the DocuElevate UI, it means a stale default `index.tsx` file (generated by Expo CLI scaffolding) is being picked up in the `mobile/app/` directory.
+
+**To fix:**
+
+1. Delete any leftover default `mobile/app/index.tsx` that is **not** the repository version (the repo version contains a `<Redirect>` to `/(auth)/`).
+2. Clear the Metro bundler cache and rebuild:
+   ```bash
+   cd mobile
+   npx expo start --clear
+   ```
+3. For production builds, run a clean EAS build:
+   ```bash
+   eas build --platform ios --clear-cache
+   ```
+
+The repository includes a root `app/index.tsx` that immediately redirects to the authentication flow, so this issue should not recur once the correct file is present.
+
+### "Session expired Local session" during iOS build
+
+EAS stores an Apple ID session locally (in `~/.expo/`) to manage code-signing certificates and provisioning profiles.  This session expires after a few weeks.
+
+**To fix:**
+
+1. **Refresh the session** by running `eas credentials` and re-authenticating with your Apple ID.
+2. **Recommended for automation:** Replace the Apple ID session with an [App Store Connect API Key](https://docs.expo.dev/app-signing/app-credentials/#app-store-connect-api-key).  API keys do not expire and work fully non-interactively:
+   - Create a key at [appstoreconnect.apple.com → Users → Integrations → Keys](https://appstoreconnect.apple.com/access/integrations/api)
+   - Download the `.p8` file and note the **Key ID** and **Issuer ID**
+   - Run `eas credentials` → iOS → *Add an App Store Connect API key*
+   - Upload the `.p8` file when prompted
+
+Once an API key is configured in EAS, automated builds (including CI and EAS Cloud Workflows) will no longer prompt for a password.
+
+### Node.js deprecation warning `[DEP0169]` during EAS build
+
+```
+(node:XXXXX) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized…
+```
+
+This warning is emitted by **EAS CLI** (an external tool) when it runs on **Node.js 22 or later**, which deprecates `url.parse()`.  It does not indicate a problem in the DocuElevate mobile app itself and will not cause a build failure on its own.
+
+The `eas.json` build profiles already include `"NODE_NO_WARNINGS": "1"` in their `env` sections to suppress this warning during EAS Cloud builds.  For local builds with a system Node.js ≥ 22, suppress it by running:
+
+```bash
+NODE_NO_WARNINGS=1 eas build --platform ios
+```
+
+or by activating the project's pinned Node.js version first:
+
+```bash
+cd mobile
+nvm use   # reads .nvmrc → Node 20.19.4 (no deprecation warning)
+eas build --platform ios
+```
+
 ### "Authentication was cancelled or failed"
 
 - Ensure the server URL is correct (including `https://`).

docs/README.md

@@ -22,6 +22,7 @@ Welcome to the DocuElevate documentation. This directory contains comprehensive
   - [Google Drive Setup](GoogleDriveSetup.md) - How to set up Google Drive integration
   - [Dropbox Setup](DropboxSetup.md) - How to set up Dropbox integration
   - [OneDrive Setup](OneDriveSetup.md) - How to set up Microsoft OneDrive/Graph integration
+  - [SharePoint Setup](SharePointSetup.md) - How to set up Microsoft SharePoint Online integration
   - [Amazon S3 Setup](AmazonS3Setup.md) - How to set up Amazon S3 integration
   - [Authentication Setup](AuthenticationSetup.md) - How to set up user authentication
   - [Notifications Setup](NotificationsSetup.md) - How to set up system notifications

docs/SettingsManagement.md

@@ -28,7 +28,7 @@ Settings are organized into logical categories for easy navigation:
 - **Authentication**: Login settings, session secrets, OAuth configuration, admin group
 - **AI Services**: AI provider selection, model configuration, embeddings, and credentials (OpenAI, Azure, Anthropic, Gemini, Ollama, OpenRouter, Portkey, LiteLLM)
 - **OCR Engines**: OCR provider selection and configuration (Tesseract, EasyOCR, Mistral, Google DocAI, AWS Textract)
-- **Storage Providers**: Dropbox, Google Drive, OneDrive, S3, FTP, SFTP, WebDAV, Nextcloud, Paperless
+- **Storage Providers**: Dropbox, Google Drive, OneDrive, SharePoint, S3, FTP, SFTP, WebDAV, Nextcloud, Paperless
 - **Email**: SMTP configuration for sending emails
 - **IMAP**: Email ingestion configuration (supports two mailbox accounts)
 - **Monitoring**: Uptime Kuma integration

docs/SharePointSetup.md

@@ -0,0 +1,185 @@
+# Setting up SharePoint Integration
+
+This guide explains how to set up the Microsoft SharePoint Online integration for DocuElevate.
+
+## Required Configuration Parameters
+
+| **Variable**                    | **Description**                                       |
+|---------------------------------|-------------------------------------------------------|
+| `SHAREPOINT_CLIENT_ID`          | Azure AD application client ID                        |
+| `SHAREPOINT_CLIENT_SECRET`      | Azure AD application client secret                    |
+| `SHAREPOINT_TENANT_ID`          | Azure AD tenant ID (use "common" for multi-tenant apps) |
+| `SHAREPOINT_REFRESH_TOKEN`      | OAuth 2.0 refresh token                               |
+| `SHAREPOINT_SITE_URL`           | SharePoint site URL (e.g. `https://tenant.sharepoint.com/sites/sitename`) |
+| `SHAREPOINT_DOCUMENT_LIBRARY`   | Document library name (default: `Documents`)          |
+| `SHAREPOINT_FOLDER_PATH`        | Subfolder path inside the document library            |
+
+For a complete list of configuration options, see the [Configuration Guide](ConfigurationGuide.md).
+
+## Overview
+
+SharePoint Online integration uses the same Microsoft Graph API as OneDrive. The key difference is that SharePoint targets a **site-specific document library** rather than a personal OneDrive. Documents are uploaded via chunked upload sessions for reliability with large files.
+
+> **Tip:** If you already have an Azure AD app registration for OneDrive, you can reuse it for SharePoint — just add the `Sites.ReadWrite.All` permission.
+
+## Setup Steps
+
+### 1. Register an application in Azure Active Directory
+
+If you don't already have an app registration (e.g. from OneDrive setup):
+
+1. Go to the [Azure Portal](https://portal.azure.com/)
+2. Navigate to **Azure Active Directory** > **App registrations**
+3. Click **New registration**
+4. Enter a name for your application (e.g., "DocuElevate")
+5. For **Supported account types**, select:
+   - **Single tenant**: "Accounts in this organizational directory only"
+   - **Multi-tenant**: "Accounts in any organizational directory"
+6. For **Redirect URI**, select "Web" and enter your callback URL (e.g., `https://your-domain.com/onedrive-callback`)
+7. Click **Register**
+
+### 2. Get Application (client) ID
+
+1. After registration, note the **Application (client) ID** from the overview page
+2. Set this value as `SHAREPOINT_CLIENT_ID`
+
+### 3. Create a client secret
+
+1. In your application page, go to **Certificates & secrets**
+2. Under **Client secrets**, click **New client secret**
+3. Add a description and select an expiration period
+4. Click **Add** and immediately copy the secret value (it will only be shown once)
+5. Set this value as `SHAREPOINT_CLIENT_SECRET`
+
+### 4. Configure API permissions
+
+1. In your application page, go to **API permissions**
+2. Click **Add a permission**
+3. Select **Microsoft Graph**
+4. For **delegated permissions** (user-context access), add:
+   - `Sites.ReadWrite.All` — Read and write items in all site collections
+   - `offline_access` — Required for refresh tokens
+5. For **application permissions** (app-only access without a user), add:
+   - `Sites.ReadWrite.All` — Read and write items in all site collections
+6. Click **Add permissions**
+7. Click **Grant admin consent** (requires admin privileges)
+
+> **Important:** SharePoint access requires `Sites.ReadWrite.All` rather than the `Files.ReadWrite` permission used by OneDrive.
+
+### 5. Get your Tenant ID
+
+1. In the Azure Portal, find your **Tenant ID** (also called "Directory ID")
+2. It is on the **Azure Active Directory** overview page
+3. Set this value as `SHAREPOINT_TENANT_ID`
+
+### 6. Generate a Refresh Token
+
+#### Using the OneDrive Auth Wizard
+
+The SharePoint integration reuses the same MSAL token flow as OneDrive:
+
+1. Navigate to `/onedrive-setup`
+2. Enter your SharePoint Client ID and Tenant ID
+3. Click **Start Authentication Flow** and follow the prompts
+4. Copy the generated refresh token and set it as `SHAREPOINT_REFRESH_TOKEN`
+
+#### Manual Method
+
+1. Open the following URL in your browser (replace placeholders):
+   ```
+   https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/authorize?client_id=YOUR_CLIENT_ID&response_type=code&redirect_uri=YOUR_REDIRECT_URI&response_mode=query&scope=https://graph.microsoft.com/.default offline_access&prompt=consent
+   ```
+2. Sign in with your Microsoft work account
+3. After authentication, copy the `code` parameter from the redirect URL
+4. Exchange the code for tokens:
+   ```bash
+   curl -X POST https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/v2.0/token \
+     -H "Content-Type: application/x-www-form-urlencoded" \
+     -d "client_id=YOUR_CLIENT_ID&scope=https://graph.microsoft.com/.default offline_access&code=YOUR_AUTH_CODE&redirect_uri=YOUR_REDIRECT_URI&grant_type=authorization_code&client_secret=YOUR_CLIENT_SECRET"
+   ```
+5. From the response JSON, copy the `refresh_token` value
+6. Set this as `SHAREPOINT_REFRESH_TOKEN`
+
+### 7. Find your SharePoint Site URL
+
+Your SharePoint site URL follows the pattern:
+```
+https://YOUR-TENANT.sharepoint.com/sites/SITE-NAME
+```
+
+For example:
+- `https://contoso.sharepoint.com/sites/documents`
+- `https://contoso.sharepoint.com/sites/engineering-team`
+
+Set this as `SHAREPOINT_SITE_URL`.
+
+### 8. Choose your Document Library
+
+Each SharePoint site has one or more document libraries. The default library is usually called `Documents` (or `Shared Documents`). You can find your library names by navigating to your SharePoint site in a browser and looking at the left sidebar.
+
+Set the library name as `SHAREPOINT_DOCUMENT_LIBRARY` (default: `Documents`).
+
+### 9. Set the Upload Folder (Optional)
+
+If you want documents to be uploaded into a subfolder inside the library, set `SHAREPOINT_FOLDER_PATH`. For example, `Uploads` or `DocuElevate/Processed`.
+
+## App-Only Access (No User Token)
+
+For fully automated scenarios without user interaction:
+
+1. Add **Application permissions** (not Delegated) for `Sites.ReadWrite.All`
+2. Grant admin consent
+3. Set `SHAREPOINT_TENANT_ID` to your organization's tenant ID
+4. Leave `SHAREPOINT_REFRESH_TOKEN` empty — the app will use the client credentials flow
+
+> **Note:** Client credentials flow requires a specific tenant ID (not "common").
+
+## Configuration Examples
+
+**With Refresh Token (Delegated Permissions):**
+```dotenv
+SHAREPOINT_CLIENT_ID=12345678-1234-1234-1234-123456789012
+SHAREPOINT_CLIENT_SECRET=your_client_secret
+SHAREPOINT_TENANT_ID=87654321-4321-4321-4321-210987654321
+SHAREPOINT_REFRESH_TOKEN=your_refresh_token
+SHAREPOINT_SITE_URL=https://contoso.sharepoint.com/sites/documents
+SHAREPOINT_DOCUMENT_LIBRARY=Documents
+SHAREPOINT_FOLDER_PATH=Uploads
+```
+
+**App-Only Access (Application Permissions):**
+```dotenv
+SHAREPOINT_CLIENT_ID=12345678-1234-1234-1234-123456789012
+SHAREPOINT_CLIENT_SECRET=your_client_secret
+SHAREPOINT_TENANT_ID=87654321-4321-4321-4321-210987654321
+# No refresh token needed for app-only access
+SHAREPOINT_SITE_URL=https://contoso.sharepoint.com/sites/documents
+SHAREPOINT_DOCUMENT_LIBRARY=Shared Documents
+SHAREPOINT_FOLDER_PATH=DocuElevate/Processed
+```
+
+## Troubleshooting
+
+### "Failed to resolve SharePoint site"
+
+- Verify `SHAREPOINT_SITE_URL` is correct and accessible
+- Ensure your app has `Sites.ReadWrite.All` permission with admin consent
+- Check that the site exists and your account has access to it
+
+### "Document library not found"
+
+- Verify the library name in `SHAREPOINT_DOCUMENT_LIBRARY` matches exactly (case-insensitive)
+- Navigate to your SharePoint site in a browser to confirm the library name
+- Common names: `Documents`, `Shared Documents`
+
+### Token errors
+
+- If using a refresh token, try re-authorizing via the OAuth flow
+- Ensure `offline_access` scope is included in your permissions
+- For app-only access, verify the tenant ID is not set to "common"
+
+### Permission errors
+
+- Ensure an admin has granted consent for `Sites.ReadWrite.All`
+- Verify the app registration has the correct permissions
+- Check that the site's sharing settings allow API access

docs/StorageArchitecture.md

@@ -341,6 +341,7 @@ in task messages or logs.
 | `S3`            | boto3 `upload_file`, per-user access key |
 | `GOOGLE_DRIVE`  | Google Drive API v3, OAuth or service account |
 | `ONEDRIVE`      | Microsoft Graph API, MSAL confidential-client |
+| `SHAREPOINT`    | Microsoft Graph API, site/drive resolution + chunked upload |
 | `WEBDAV`        | HTTP PUT request, Basic Auth |
 | `NEXTCLOUD`     | WebDAV (same as WEBDAV, Nextcloud-compatible path) |
 | `FTP`           | ftplib FTPS (TLS preferred, plaintext configurable) |

docs/Troubleshooting.md

@@ -2,6 +2,8 @@
 
 This document provides solutions to common problems encountered when using DocuElevate.
 
+> **Tip:** For configuration-specific issues, see also the [Configuration Troubleshooting](ConfigurationTroubleshooting.md) guide.
+
 ## Common Issues
 
 ### Application Won't Start
@@ -14,7 +16,7 @@ This document provides solutions to common problems encountered when using DocuE
 #### Possible Solutions
 1. **Check environment variables**
    ```bash
-   docker-compose config
+   docker compose config
    ```
    Ensure all required variables are set properly in your `.env` file.
 
@@ -30,6 +32,18 @@ This document provides solutions to common problems encountered when using DocuE
    ```
    Ensure the port isn't already in use by another application.
 
+4. **Check Redis connectivity**
+   ```bash
+   docker compose logs redis
+   ```
+   Ensure Redis is running — both the API server and Celery worker depend on it.
+
+5. **Check database migrations**
+   ```bash
+   docker compose exec api alembic upgrade head
+   ```
+   Ensure the database schema is up-to-date.
+
 ### Document Upload Fails
 
 #### Symptoms
@@ -39,41 +53,51 @@ This document provides solutions to common problems encountered when using DocuE
 
 #### Possible Solutions
 1. **Check file size limits**
-   - Default maximum file size is 100MB
-   - Adjust `client_max_body_size` in your reverse proxy configuration
+   - Default maximum file size is 1 GB (`MAX_UPLOAD_SIZE`)
+   - Individual file limit: `MAX_SINGLE_FILE_SIZE` (default: same as `MAX_UPLOAD_SIZE`)
+   - If using a reverse proxy, adjust `client_max_body_size` (Nginx) or equivalent
 
 2. **Verify storage space**
    ```bash
    df -h
    ```
-   Ensure there's sufficient disk space available.
+   Ensure there's sufficient disk space on the workdir volume.
 
 3. **Check worker process**
    ```bash
-   docker-compose logs worker
+   docker compose logs worker
    ```
    Verify the Celery worker is running and processing tasks.
 
+4. **Check upload quota**
+   If multi-user mode and subscriptions are enabled, verify the user hasn't exceeded their daily upload limit (`DEFAULT_DAILY_UPLOAD_LIMIT`).
+
 ### OCR or Text Extraction Issues
 
 #### Symptoms
 - Documents upload but text isn't extracted
 - Poor quality text extraction
-- API errors related to Azure services
+- API errors related to OCR services
 
 #### Possible Solutions
-1. **Verify API credentials**
-   Check the Azure Document Intelligence API key and endpoint in your `.env` file.
+1. **Verify the configured OCR provider**
+   Check which provider is set via the `OCR_PROVIDER` environment variable (defaults to Azure Document Intelligence).
 
-2. **Check document quality**
+2. **Verify API credentials**
+   Check the credentials for your configured OCR provider in your `.env` file:
+   - **Azure**: `AZURE_DI_KEY` and `AZURE_DI_ENDPOINT`
+   - **Tesseract**: No credentials required (local), but ensure `TESSERACT_LANGUAGES` is set
+   - **EasyOCR**: No credentials required (local)
+   - **Mistral**: `MISTRAL_OCR_API_KEY`
+   - **Google Document AI**: `GOOGLE_DOCAI_PROJECT_ID`, `GOOGLE_DOCAI_LOCATION`, `GOOGLE_DOCAI_PROCESSOR_ID`
+   - **AWS Textract**: `AWS_TEXTRACT_ACCESS_KEY_ID`, `AWS_TEXTRACT_SECRET_ACCESS_KEY`, `AWS_TEXTRACT_REGION`
+
+3. **Check document quality**
    - Ensure documents are clearly scanned
    - Try preprocessing images to improve quality before upload
 
-3. **Test API connectivity**
-   ```bash
-   curl -X GET -H "Ocp-Apim-Subscription-Key: YOUR_KEY" "YOUR_ENDPOINT"
-   ```
-   Ensure the API is accessible from your server.
+4. **Try multi-provider OCR**
+   Configure `OCR_PROVIDERS` (comma-separated list) with a merge strategy (`OCR_MERGE_STRATEGY`: `ai_merge`, `longest`, or `primary`) for better results.
 
 ### Email Integration Problems
 
@@ -84,92 +108,226 @@ This document provides solutions to common problems encountered when using DocuE
 
 #### Possible Solutions
 1. **Verify IMAP settings**
-   Check host, port, username, and password in your configuration.
+   Check host, port, username, and password for `IMAP1_*` / `IMAP2_*` in your configuration.
 
 2. **Test IMAP connectivity**
    ```bash
-   telnet mail.example.com 993
+   docker compose exec api python -c "import imaplib; m = imaplib.IMAP4_SSL('mail.example.com', 993); print('OK')"
    ```
-   Ensure the IMAP server is accessible.
+   Ensure the IMAP server is accessible from the container.
 
-3. **Enable less secure apps**
-   For Gmail and some providers, you may need to enable access for less secure apps or use app-specific passwords.
+3. **Check for app-specific passwords**
+   For Gmail and some providers, you must use app-specific passwords instead of your account password.
 
 4. **Check firewall settings**
-   Ensure your server can make outbound connections to the mail server.
+   Ensure your server can make outbound connections to the mail server on port 993 (IMAP SSL).
+
+5. **Check attachment filter**
+   If only certain attachments are expected, verify `IMAP_ATTACHMENT_FILTER` is set correctly (`documents_only` or `all`).
 
 ### Storage Integration Issues
 
 #### Symptoms
-- Files aren't appearing in Dropbox/Nextcloud/Paperless
+- Files aren't appearing in configured storage destinations
 - Authentication errors in logs
 - API rate limiting errors
 
 #### Possible Solutions
 1. **Verify API credentials**
-   Double-check all API keys, tokens, and secrets.
+   Double-check all API keys, tokens, and secrets for the relevant service.
 
 2. **Check access permissions**
-   Ensure the application has write permissions to the specified folders.
+   Ensure the application has write permissions to the specified folders/buckets.
 
 3. **Refresh tokens**
-   For OAuth-based services like Dropbox, try generating new refresh tokens.
+   For OAuth-based services like Dropbox, Google Drive, and OneDrive, try re-authorizing through the integration setup pages.
 
 4. **Examine detailed logs**
    ```bash
-   docker-compose logs worker | grep -i dropbox
+   docker compose logs worker | grep -i "upload_to"
    ```
-   Look for specific error messages related to the service.
+   Look for specific error messages related to the storage service.
+
+5. **Check integration status**
+   Visit the **Integrations** page in the web UI to verify the connection status of each configured storage backend.
+
+## Search Issues
+
+### Symptoms
+- Search returns no results or incomplete results
+- Search page shows an error
+
+### Possible Solutions
+1. **Check Meilisearch is running**
+   ```bash
+   docker compose logs meilisearch
+   ```
+   Ensure the Meilisearch container is healthy and accepting connections.
+
+2. **Verify Meilisearch URL**
+   Check `MEILISEARCH_URL` in your `.env` file (default: `http://meilisearch:7700`).
+
+3. **Rebuild the search index**
+   If documents are missing from search results, reprocessing them will re-index their content.
+
+## Pipeline & Routing Issues
+
+### Symptoms
+- Documents are not processed according to pipeline steps
+- Routing rules don't match expected documents
+
+### Possible Solutions
+1. **Verify pipeline assignment**
+   On the file detail page, check which pipeline (if any) is assigned. The system pipeline applies to all documents by default.
+
+2. **Test routing rules**
+   Use the **Evaluate** button on the Routing Rules page to test whether a rule matches a specific document.
+
+3. **Check step ordering**
+   Pipeline steps execute in order — ensure OCR comes before metadata extraction if the AI step depends on extracted text.
 
 ## Database Issues
 
-#### Symptoms
+### Symptoms
 - Application errors related to database connections
 - Missing or corrupt data
 - Slow performance
 
-#### Possible Solutions
+### Possible Solutions
 1. **Check database connection string**
    Verify the `DATABASE_URL` variable in your `.env` file.
 
 2. **Inspect database integrity**
+   For SQLite:
    ```bash
    sqlite3 database.db "PRAGMA integrity_check;"
    ```
-   (For SQLite databases)
+   For PostgreSQL (recommended for production):
+   ```bash
+   docker compose exec api python -c "from app.database import engine; print(engine.url)"
+   ```
 
 3. **Perform database migrations**
    ```bash
-   docker-compose exec api alembic upgrade head
+   docker compose exec api alembic upgrade head
    ```
    Ensure the database schema is up-to-date.
 
+4. **Consider PostgreSQL for production**
+   SQLite is suitable for small deployments, but PostgreSQL is recommended for multi-user production environments. See the [Database Configuration Guide](DatabaseConfiguration.md).
+
 ## Authentication Problems
 
-#### Symptoms
+### Symptoms
 - Unable to log in
 - Redirect loops during authentication
 - OAuth errors
 
-#### Possible Solutions
-1. **Verify Authentik configuration**
-   Check client ID, client secret, and configuration URL.
+### Possible Solutions
+1. **Verify OAuth/OIDC configuration**
+   Check client ID, client secret, and configuration URL for your identity provider.
 
 2. **Check callback URLs**
-   Ensure the redirect URIs are correctly configured in your OAuth provider.
+   Ensure the redirect URIs are correctly configured in your OAuth provider. The callback URL is typically `https://your-domain/auth/callback`.
 
 3. **Clear browser cookies and cache**
    Authentication issues can sometimes be resolved by clearing browser data.
 
+4. **Check social login credentials**
+   If using social login (Google, Microsoft, Apple, Dropbox), verify the corresponding `SOCIAL_AUTH_*` environment variables.
+
+5. **Verify `EXTERNAL_HOSTNAME`**
+   The `EXTERNAL_HOSTNAME` setting must match the domain users access DocuElevate from — OAuth redirect URLs depend on it.
+
+## Mobile App Issues
+
+### Symptoms
+- Can't connect to DocuElevate from the mobile app
+- Push notifications not received
+- Login fails
+
+### Possible Solutions
+1. **Verify the server URL**
+   Ensure the mobile app is configured with the correct DocuElevate server URL (including `https://`).
+
+2. **Check API token**
+   Generate a fresh API token from the web UI (Profile → API Tokens) and enter it in the mobile app settings.
+
+3. **Check network connectivity**
+   The mobile device must be able to reach your DocuElevate server. If using a private network, ensure VPN is connected.
+
+4. **Push notifications**
+   Push notifications require a valid Expo push token. Check the app settings and ensure notifications are enabled at the OS level.
+
+See the [Mobile App Guide](MobileApp.md) for detailed setup instructions.
+
+## CLI Issues
+
+### Symptoms
+- CLI commands fail with connection errors
+- Authentication rejected
+
+### Possible Solutions
+1. **Verify URL and token**
+   ```bash
+   docuelevate --url https://your-instance --token de_xxx list
+   ```
+   Ensure the URL is correct (include the scheme) and the API token is valid.
+
+2. **Check environment variables**
+   The CLI reads `DOCUELEVATE_URL` and `DOCUELEVATE_API_TOKEN` from the environment. Verify they are exported.
+
+3. **Test API directly**
+   ```bash
+   curl -H "Authorization: Bearer de_xxx" https://your-instance/api/files
+   ```
+   If this fails, the issue is with the server, not the CLI.
+
+See the [CLI Guide](CLIGuide.md) for detailed usage.
+
+## Performance Issues
+
+### Symptoms
+- Slow document processing
+- High memory usage
+- Queue backing up
+
+### Possible Solutions
+1. **Check worker concurrency**
+   The Celery worker processes tasks in parallel. If the queue is backing up, consider scaling workers or adjusting concurrency.
+
+2. **Enable batch throttling**
+   Set `PROCESSALL_THROTTLE_THRESHOLD` and `PROCESSALL_THROTTLE_DELAY` to prevent overwhelming external APIs.
+
+3. **Monitor the queue**
+   Visit the **Admin → Queue** page to see pending, active, and failed tasks.
+
+4. **Use PostgreSQL**
+   SQLite can become a bottleneck under load. Migrate to PostgreSQL for better concurrent performance. See the [Database Configuration Guide](DatabaseConfiguration.md).
+
+5. **Check Redis memory**
+   ```bash
+   docker compose exec redis redis-cli info memory
+   ```
+   Ensure Redis has sufficient memory for the task queue and cache.
+
 ## Getting Additional Help
 
 If you continue to experience issues after trying these solutions:
 
-1. **Check the logs** for detailed error messages
+1. **Check the logs** for detailed error messages:
    ```bash
-   docker-compose logs --tail=100
+   docker compose logs --tail=200
    ```
 
-2. **Open an issue** on the [GitHub repository](https://github.com/christianlouis/document-processor/issues)
+2. **Check the status page** at `/status` in the web UI for an overview of all service connections.
 
-3. **Contact the developer** via the information provided on the About page
+3. **Open an issue** on the [GitHub repository](https://github.com/christianlouis/DocuElevate/issues) with:
+   - A description of the problem
+   - Relevant log output
+   - Your DocuElevate version (shown on the About page or in the `VERSION` file)
+
+4. **Consult additional documentation**:
+   - [Configuration Guide](ConfigurationGuide.md) — All environment variables
+   - [Configuration Troubleshooting](ConfigurationTroubleshooting.md) — Configuration-specific issues
+   - [Deployment Guide](DeploymentGuide.md) — Infrastructure and deployment

docs/UserGuide.md

@@ -63,6 +63,15 @@ DocuElevate features a simple navigation system with the following main sections
 - **Search**: Dedicated full-text search across all document content
 - **About**: Information about DocuElevate
 
+### Other Ways to Use DocuElevate
+
+Beyond the web interface, DocuElevate is available through several additional clients:
+
+- **Mobile App (iOS & Android)** — Capture documents with your phone camera or upload from your photo library. See the [Mobile App Guide](MobileApp.md) for setup and usage.
+- **Browser Extension** — Clip web pages or send files to DocuElevate directly from Chrome, Firefox, or Edge. See the [Browser Extension Guide](BrowserExtension.md) for installation.
+- **CLI Tool** — Upload, download, search, and manage documents from the command line or scripts. See the [CLI Guide](CLIGuide.md) for details.
+- **REST & GraphQL API** — Full programmatic access for automation and integrations. See the [API Documentation](API.md).
+
 ## Uploading Documents
 
 DocuElevate provides multiple convenient ways to upload documents to the system.
@@ -161,7 +170,7 @@ The **Integrations** page (`/integrations`) provides a unified view of all your
    - **S3** — bucket, region, access key, secret key
    - **WebDAV / Nextcloud** — URL, folder, username, password
    - **FTP / SFTP** — host, port, remote path, username, password
-   - **Dropbox / Google Drive / OneDrive** — folder path, with a link to the OAuth setup page
+   - **Dropbox / Google Drive / OneDrive / SharePoint** — folder path, with a link to the OAuth setup page
    - **Email Forward** — recipient email address
    - **Watch Folder** — source type (Local, S3, Dropbox, Google Drive, OneDrive, Nextcloud, WebDAV), per-type config fields, delete after processing toggle
    - **Paperless NGX** — URL and API token

fix_test7.py

@@ -0,0 +1,53 @@
+import re
+
+with open("tests/test_api_saved_searches.py", "r") as f:
+    content = f.read()
+
+# We need to mock get_current_user in app.api.saved_searches (which is imported from app.auth)
+# because saved searches uses `_get_user_id` which calls `get_current_user(request)`.
+# But `_get_user_id` is NOT a dependency injected via `Depends`!
+# Let's verify `app/api/saved_searches.py` uses `Depends` or just calls it.
+
+# In `app/api/saved_searches.py`:
+# def _get_user_id(request: Request) -> str:
+#     user = get_current_user(request)
+#     if user:
+#         return user.get("preferred_username") ...
+# It's called directly inside the routes: `user_id = _get_user_id(request)`
+# It doesn't use `Depends(_get_user_id)`.
+# Ah! But earlier I saw `_get_user_id` wasn't mocked properly. Let's use patch to mock `_get_user_id`.
+
+# Wait, `TestClient` can be given an active session, but `app.auth.get_current_user` uses `request.session.get("user")` or Bearer token.
+# Is `AUTH_ENABLED` false? The test env has `os.environ["AUTH_ENABLED"] = "False"` in `tests/conftest.py`.
+# If `AUTH_ENABLED` is false, `require_login` is a no-op, and `_get_user_id` falls back to "anonymous".
+# Actually, `_get_user_id` returns "anonymous" if `get_current_user(request)` is None.
+# If `_OWNER` is "test_user@example.com", we should probably just patch `_get_user_id`.
+
+replacement = """def _make_client(int_engine, owner_id: str = _OWNER):
+    \"\"\"Return a TestClient with *owner_id* injected as the authenticated user.\"\"\"
+    from app.main import app
+    from unittest.mock import patch
+
+    def override_db():
+        Session = sessionmaker(bind=int_engine)
+        session = Session()
+        try:
+            yield session
+        finally:
+            session.close()
+
+    app.dependency_overrides[get_db] = override_db
+    with patch("app.api.saved_searches._get_user_id", return_value=owner_id):
+        with TestClient(app, base_url="http://localhost", raise_server_exceptions=False) as client:
+            yield client
+    app.dependency_overrides.clear()"""
+
+content = re.sub(
+    r"def _make_client\(int_engine, owner_id: str = _OWNER\):.*?(?=@pytest\.fixture\(\)\ndef int_client\(int_engine\):)",
+    replacement + "\n\n\n",
+    content,
+    flags=re.DOTALL
+)
+
+with open("tests/test_api_saved_searches.py", "w") as f:
+    f.write(content)

frontend/static/js/common.js

@@ -165,11 +165,11 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
           'flex items-center gap-2 px-2 py-1 rounded-md text-gray-700 hover:text-gray-900 hover:bg-gray-100 focus:outline-none focus:ring-2 focus:ring-inset focus:ring-blue-500';
         btn.setAttribute('aria-haspopup', 'true');
         btn.setAttribute('aria-expanded', 'false');
-        btn.setAttribute('aria-label', `Account menu for ${displayName}`);
+        btn.setAttribute('aria-label', `${((window.__i18n?.accountMenuFor) || 'Account menu for {name}').replace('{name}', displayName)}`);
 
         const avatar = document.createElement('img');
         avatar.src = data.picture;
-        avatar.alt = 'Avatar';
+        avatar.alt = window.__i18n.avatar || 'Avatar';
         avatar.className = 'w-8 h-8 rounded-full';
 
         const nameSpan = document.createElement('span');
@@ -189,7 +189,7 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         menu.className =
           'absolute right-0 mt-2 w-52 bg-white rounded-md shadow-lg ring-1 ring-black ring-opacity-5 z-50 hidden';
         menu.setAttribute('role', 'menu');
-        menu.setAttribute('aria-label', 'Account menu');
+        menu.setAttribute('aria-label', window.__i18n.accountMenu || 'Account menu');
 
         // User info header
         const header = document.createElement('div');
@@ -207,16 +207,19 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         const linksDiv = document.createElement('div');
         linksDiv.className = 'py-1';
         linksDiv.appendChild(
-          _makeMenuLink('/profile', 'fas fa-user-circle text-blue-400', 'Profile Settings', 'text-gray-700')
+          _makeMenuLink('/profile', 'fas fa-user-circle text-blue-400', window.__i18n.profileSettings || 'Profile Settings', 'text-gray-700')
         );
         linksDiv.appendChild(
-          _makeMenuLink('/subscription', 'fas fa-layer-group text-indigo-400', 'My Subscription', 'text-gray-700')
+          _makeMenuLink('/subscription', 'fas fa-layer-group text-indigo-400', window.__i18n.mySubscription || 'My Subscription', 'text-gray-700')
         );
         linksDiv.appendChild(
-          _makeMenuLink('/api-tokens', 'fas fa-key text-yellow-500', 'API Tokens', 'text-gray-700')
+          _makeMenuLink('/api-tokens', 'fas fa-key text-yellow-500', window.__i18n.apiTokens || 'API Tokens', 'text-gray-700')
         );
         linksDiv.appendChild(
-          _makeMenuLink('/shared-links', 'fas fa-share-alt text-blue-400', 'Shared Links', 'text-gray-700')
+          _makeMenuLink('/devices', 'fas fa-mobile-alt text-blue-500', window.__i18n.devices || 'Devices', 'text-gray-700')
+        );
+        linksDiv.appendChild(
+          _makeMenuLink('/shared-links', 'fas fa-share-alt text-blue-400', window.__i18n.sharedLinks || 'Shared Links', 'text-gray-700')
         );
 
         // Divider + Sign Out
@@ -225,7 +228,7 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         const signOutDiv = document.createElement('div');
         signOutDiv.className = 'py-1';
         signOutDiv.appendChild(
-          _makeMenuLink('/logout', 'fas fa-sign-out-alt text-red-400', 'Sign Out', 'text-red-600')
+          _makeMenuLink('/logout', 'fas fa-sign-out-alt text-red-400', window.__i18n.signOut || 'Sign Out', 'text-red-600')
         );
 
         menu.appendChild(header);
@@ -259,7 +262,7 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         userRow.className = 'flex items-center gap-3 px-3 py-3';
         const mAvatar = document.createElement('img');
         mAvatar.src = data.picture;
-        mAvatar.alt = 'Avatar';
+        mAvatar.alt = window.__i18n.avatar || 'Avatar';
         mAvatar.className = 'w-8 h-8 rounded-full flex-shrink-0';
         const mUserInfo = document.createElement('div');
         mUserInfo.className = 'min-w-0';
@@ -284,7 +287,7 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         profileIcon.className = 'fas fa-user-circle mr-2 text-blue-400';
         profileIcon.setAttribute('aria-hidden', 'true');
         profileLink.appendChild(profileIcon);
-        profileLink.appendChild(document.createTextNode('Profile Settings'));
+        profileLink.appendChild(document.createTextNode(window.__i18n.profileSettings || 'Profile Settings'));
         mobileAuthSection.appendChild(profileLink);
 
         // Subscription link
@@ -296,7 +299,7 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         subIcon.className = 'fas fa-layer-group mr-2 text-indigo-400';
         subIcon.setAttribute('aria-hidden', 'true');
         subLink.appendChild(subIcon);
-        subLink.appendChild(document.createTextNode('My Subscription'));
+        subLink.appendChild(document.createTextNode(window.__i18n.mySubscription || 'My Subscription'));
         mobileAuthSection.appendChild(subLink);
 
         // API Tokens link
@@ -308,9 +311,21 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         tokensIcon.className = 'fas fa-key mr-2 text-yellow-500';
         tokensIcon.setAttribute('aria-hidden', 'true');
         tokensLink.appendChild(tokensIcon);
-        tokensLink.appendChild(document.createTextNode('API Tokens'));
+        tokensLink.appendChild(document.createTextNode(window.__i18n.apiTokens || 'API Tokens'));
         mobileAuthSection.appendChild(tokensLink);
 
+        // Devices link
+        const devicesLink = document.createElement('a');
+        devicesLink.href = '/devices';
+        devicesLink.className =
+          'flex items-center px-3 py-3 rounded-md text-base font-medium text-gray-700 hover:text-gray-900 hover:bg-gray-50';
+        const devicesIcon = document.createElement('i');
+        devicesIcon.className = 'fas fa-mobile-alt mr-2 text-blue-500';
+        devicesIcon.setAttribute('aria-hidden', 'true');
+        devicesLink.appendChild(devicesIcon);
+        devicesLink.appendChild(document.createTextNode(window.__i18n.devices || 'Devices'));
+        mobileAuthSection.appendChild(devicesLink);
+
         // Shared Links link
         const sharedLinksLink = document.createElement('a');
         sharedLinksLink.href = '/shared-links';
@@ -320,7 +335,7 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         sharedLinksIcon.className = 'fas fa-share-alt mr-2 text-blue-400';
         sharedLinksIcon.setAttribute('aria-hidden', 'true');
         sharedLinksLink.appendChild(sharedLinksIcon);
-        sharedLinksLink.appendChild(document.createTextNode('Shared Links'));
+        sharedLinksLink.appendChild(document.createTextNode(window.__i18n.sharedLinks || 'Shared Links'));
         mobileAuthSection.appendChild(sharedLinksLink);
 
         // Logout link
@@ -332,7 +347,7 @@ function _makeMenuLink(href, iconClass, label, extraClasses = '') {
         logoutIcon.className = 'fas fa-sign-out-alt mr-2';
         logoutIcon.setAttribute('aria-hidden', 'true');
         logoutLink.appendChild(logoutIcon);
-        logoutLink.appendChild(document.createTextNode('Sign Out'));
+        logoutLink.appendChild(document.createTextNode(window.__i18n.signOut || 'Sign Out'));
         mobileAuthSection.appendChild(logoutLink);
       }
     } else {
@@ -367,7 +382,7 @@ function _renderLoggedOutAuth(authSection, mobileAuthSection) {
     loginLink.href = '/login';
     loginLink.className =
       'px-3 py-1.5 rounded-md text-sm font-medium text-gray-700 hover:text-gray-900 hover:bg-gray-100 border border-gray-300';
-    loginLink.textContent = 'Log In';
+    loginLink.textContent = window.__i18n.logIn || 'Log In';
     row.appendChild(loginLink);
 
     if (multiUser) {
@@ -375,7 +390,7 @@ function _renderLoggedOutAuth(authSection, mobileAuthSection) {
       startLink.href = startHref;
       startLink.className =
         'px-3 py-1.5 rounded-md text-sm font-medium text-white bg-blue-600 hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500';
-      startLink.textContent = allowSignup ? 'Sign Up' : 'Get Started';
+      startLink.textContent = allowSignup ? (window.__i18n.signUp || 'Sign Up') : (window.__i18n.getStarted || 'Get Started');
       row.appendChild(startLink);
     }
 
@@ -393,7 +408,7 @@ function _renderLoggedOutAuth(authSection, mobileAuthSection) {
     loginIcon.className = 'fas fa-sign-in-alt mr-2';
     loginIcon.setAttribute('aria-hidden', 'true');
     loginLink.appendChild(loginIcon);
-    loginLink.appendChild(document.createTextNode('Log In'));
+    loginLink.appendChild(document.createTextNode(window.__i18n.logIn || 'Log In'));
     mobileAuthSection.appendChild(loginLink);
 
     if (multiUser) {
@@ -405,7 +420,7 @@ function _renderLoggedOutAuth(authSection, mobileAuthSection) {
       startIcon.className = 'fas fa-arrow-right mr-2';
       startIcon.setAttribute('aria-hidden', 'true');
       startLink.appendChild(startIcon);
-      startLink.appendChild(document.createTextNode(allowSignup ? 'Sign Up' : 'Get Started'));
+      startLink.appendChild(document.createTextNode(allowSignup ? (window.__i18n.signUp || 'Sign Up') : (window.__i18n.getStarted || 'Get Started')));
       mobileAuthSection.appendChild(startLink);
     }
   }

frontend/templates/admin_plans.html

@@ -1,6 +1,6 @@
 {% extends "base.html" %}
 
-{% block title %}Plan Designer — DocuElevate Admin{% endblock %}
+{% block title %}{{ _("admin_plans.page_title") }}{% endblock %}
 
 {% block content %}
 <main id="main-content" class="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8 py-8"
@@ -10,43 +10,41 @@
   <!-- Header -->
   <div class="flex items-center justify-between mb-6">
     <div>
-      <h1 class="text-2xl font-bold text-gray-900">Plan Designer</h1>
-      <p class="text-sm text-gray-500 mt-1">Manage subscription plans shown on the public pricing page.</p>
+      <h1 class="text-2xl font-bold text-gray-900">{{ _("admin_plans.heading") }}</h1>
+      <p class="text-sm text-gray-500 mt-1">{{ _("admin_plans.subheading") }}</p>
     </div>
     <div class="flex items-center gap-3">
       <a href="/admin/stripe-wizard"
          class="inline-flex items-center px-4 py-2 border border-indigo-300 rounded-md text-sm font-medium text-indigo-700 bg-indigo-50 hover:bg-indigo-100 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-indigo-400"
-         title="Open the Stripe Setup Wizard to configure API keys and sync plans"
+         title="{{ _('admin_plans.btn_stripe_setup_title') }}"
       >
-        <i class="fab fa-stripe mr-2" aria-hidden="true"></i> Stripe Setup
+        <i class="fab fa-stripe mr-2" aria-hidden="true"></i> {{ _("admin_plans.btn_stripe_setup") }}
       </a>
       <button
         @click="seedDefaults()"
         :disabled="seeding"
         class="inline-flex items-center px-4 py-2 border border-gray-300 rounded-md text-sm font-medium text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-indigo-400 disabled:opacity-50"
-        title="Restore all four default plans (only if no plans exist yet)"
+        title="{{ _('admin_plans.btn_restore_defaults_title') }}"
       >
         <i class="fas fa-undo mr-2 text-gray-400" aria-hidden="true"></i>
-        <span x-show="!seeding">Restore Defaults</span>
-        <span x-show="seeding"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Restoring…</span>
+        <span x-show="!seeding">{{ _("admin_plans.btn_restore_defaults") }}</span>
+        <span x-show="seeding"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> {{ _("admin_plans.btn_restoring") }}</span>
       </button>
       <button
         @click="openCreateModal()"
         class="inline-flex items-center px-4 py-2 rounded-md text-sm font-medium text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-indigo-500"
       >
-        <i class="fas fa-plus mr-2" aria-hidden="true"></i> Add Plan
+        <i class="fas fa-plus mr-2" aria-hidden="true"></i> {{ _("admin_plans.btn_add_plan") }}
       </button>
     </div>
   </div>
 
   <!-- Overage callout -->
   <div class="mb-6 rounded-lg border border-indigo-200 bg-indigo-50 p-4 text-sm text-indigo-800" role="note">
-    <p class="font-semibold mb-1"><i class="fas fa-info-circle mr-1" aria-hidden="true"></i> About the Overage Buffer</p>
+    <p class="font-semibold mb-1"><i class="fas fa-info-circle mr-1" aria-hidden="true"></i> {{ _("admin_plans.overage_buffer_title") }}</p>
     <p>
-      The overage buffer is <strong>invisible to users</strong>. We advertise X docs/month but only enforce
-      at <strong>X × (1 + buffer%)</strong> docs. For example, a 150-doc/month plan with a 20% buffer
-      enforces at 180 docs. This prevents hard cutoffs at the exact announced limit, giving users a
-      graceful soft landing.
+      {{ _("admin_plans.overage_buffer_body_prefix") }} <strong>{{ _("admin_plans.overage_buffer_invisible") }}</strong>. {{ _("admin_plans.overage_buffer_body_suffix") }}
+      <strong>{{ _("admin_plans.overage_buffer_formula") }}</strong> {{ _("admin_plans.overage_buffer_tail") }}
     </p>
   </div>
 
@@ -63,29 +61,29 @@
   <!-- Loading -->
   <div x-show="loading" class="text-center py-12 text-gray-400">
     <i class="fas fa-spinner fa-spin text-2xl" aria-hidden="true"></i>
-    <p class="mt-2 text-sm">Loading plans…</p>
+    <p class="mt-2 text-sm">{{ _("admin_plans.loading") }}</p>
   </div>
 
   <!-- Plans table -->
   <div x-show="!loading" class="bg-white shadow-sm rounded-lg overflow-hidden border border-gray-200">
-    <table class="min-w-full divide-y divide-gray-200" aria-label="Subscription plans">
+    <table class="min-w-full divide-y divide-gray-200" aria-label="{{ _('admin_plans.table_aria_label') }}">
       <thead class="bg-gray-50">
         <tr>
-          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Order</th>
-          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Plan</th>
-          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">Monthly</th>
-          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">Yearly</th>
-          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">Monthly Limit</th>
-          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">Overage %</th>
-          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">Active</th>
-          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">Actions</th>
+          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_plans.col_order") }}</th>
+          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_plans.col_plan") }}</th>
+          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_plans.col_monthly") }}</th>
+          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_plans.col_yearly") }}</th>
+          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_plans.col_monthly_limit") }}</th>
+          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_plans.col_overage_pct") }}</th>
+          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_plans.col_active") }}</th>
+          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_plans.col_actions") }}</th>
         </tr>
       </thead>
       <tbody class="bg-white divide-y divide-gray-100">
         <template x-if="plans.length === 0">
           <tr>
             <td colspan="8" class="px-4 py-8 text-center text-sm text-gray-400">
-              No plans yet. Click <strong>Restore Defaults</strong> to seed the four built-in plans.
+              {{ _("admin_plans.no_plans_intro") }} <strong>{{ _("admin_plans.btn_restore_defaults") }}</strong> {{ _("admin_plans.no_plans_suffix") }}
             </td>
           </tr>
         </template>
@@ -97,13 +95,13 @@
                   @click="moveUp(idx)"
                   :disabled="idx === 0"
                   class="p-1 rounded hover:bg-gray-200 disabled:opacity-30"
-                  :aria-label="'Move ' + plan.name + ' up'"
+                  :aria-label="i18n.ariaMoveUp.replace('{name}', plan.name)"
                 ><i class="fas fa-chevron-up text-xs" aria-hidden="true"></i></button>
                 <button
                   @click="moveDown(idx)"
                   :disabled="idx === plans.length - 1"
                   class="p-1 rounded hover:bg-gray-200 disabled:opacity-30"
-                  :aria-label="'Move ' + plan.name + ' down'"
+                  :aria-label="i18n.ariaMoveDown.replace('{name}', plan.name)"
                 ><i class="fas fa-chevron-down text-xs" aria-hidden="true"></i></button>
                 <span x-text="idx + 1" class="w-5 text-center text-xs text-gray-400"></span>
               </div>
@@ -115,13 +113,13 @@
                   <span class="text-xs px-2 py-0.5 rounded-full bg-indigo-100 text-indigo-700 font-medium" x-text="plan.badge_text"></span>
                 </template>
                 <template x-if="plan.is_highlighted">
-                  <span class="text-xs px-2 py-0.5 rounded-full bg-yellow-100 text-yellow-700 font-medium"><i class="fas fa-star" aria-hidden="true"></i> Featured</span>
+                  <span class="text-xs px-2 py-0.5 rounded-full bg-yellow-100 text-yellow-700 font-medium"><i class="fas fa-star" aria-hidden="true"></i> <span x-text="i18n.featuredBadge"></span></span>
                 </template>
               </div>
               <div class="text-xs text-gray-400 mt-0.5" x-text="plan.plan_id"></div>
             </td>
             <td class="px-4 py-3 text-right text-sm text-gray-700">
-              <span x-text="plan.price_monthly === 0 ? 'Free' : '$' + plan.price_monthly.toFixed(2)"></span>
+              <span x-text="plan.price_monthly === 0 ? i18n.freeLabel : '$' + plan.price_monthly.toFixed(2)"></span>
             </td>
             <td class="px-4 py-3 text-right text-sm text-gray-700">
               <span x-text="plan.price_yearly === 0 ? '—' : '$' + plan.price_yearly.toFixed(2)"></span>
@@ -136,7 +134,7 @@
               <span
                 class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium"
                 :class="plan.is_active ? 'bg-green-100 text-green-700' : 'bg-gray-100 text-gray-500'"
-                x-text="plan.is_active ? 'Active' : 'Inactive'"
+                x-text="plan.is_active ? i18n.statusActive : i18n.statusInactive"
               ></span>
             </td>
             <td class="px-4 py-3 text-right">
@@ -144,16 +142,16 @@
                 <button
                   @click="openEditModal(plan)"
                   class="text-sm text-indigo-600 hover:text-indigo-800 font-medium"
-                  :aria-label="'Edit ' + plan.name"
+                  :aria-label="i18n.ariaEditPlan.replace('{name}', plan.name)"
                 >
-                  <i class="fas fa-pencil-alt" aria-hidden="true"></i> Edit
+                  <i class="fas fa-pencil-alt" aria-hidden="true"></i> <span x-text="i18n.btnEdit"></span>
                 </button>
                 <button
                   @click="deletePlan(plan.plan_id)"
                   class="text-sm text-red-500 hover:text-red-700 font-medium"
-                  :aria-label="'Delete ' + plan.name"
+                  :aria-label="i18n.ariaDeletePlan.replace('{name}', plan.name)"
                 >
-                  <i class="fas fa-trash-alt" aria-hidden="true"></i> Delete
+                  <i class="fas fa-trash-alt" aria-hidden="true"></i> <span x-text="i18n.btnDelete"></span>
                 </button>
               </div>
             </td>
@@ -171,8 +169,8 @@
       class="inline-flex items-center px-4 py-2 rounded-md text-sm font-medium text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-indigo-500 disabled:opacity-50"
     >
       <i class="fas fa-save mr-2" aria-hidden="true"></i>
-      <span x-show="!saving">Save Order</span>
-      <span x-show="saving"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Saving…</span>
+      <span x-show="!saving">{{ _("admin_plans.btn_save_order") }}</span>
+      <span x-show="saving"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> {{ _("admin_plans.btn_saving") }}</span>
     </button>
   </div>
 
@@ -195,8 +193,8 @@
     <div class="bg-white rounded-lg shadow-xl w-full max-w-2xl my-auto" @click.outside="modalOpen = false">
       <!-- Modal header -->
       <div class="flex items-center justify-between px-6 py-4 border-b">
-        <h2 id="modal-title" class="text-lg font-semibold text-gray-900" x-text="isCreate ? 'Add Plan' : 'Edit Plan: ' + form.name"></h2>
-        <button @click="modalOpen = false" class="text-gray-400 hover:text-gray-600" aria-label="Close modal">
+        <h2 id="modal-title" class="text-lg font-semibold text-gray-900" x-text="isCreate ? i18n.modalCreateTitle : i18n.modalEditTitlePrefix + form.name"></h2>
+        <button @click="modalOpen = false" class="text-gray-400 hover:text-gray-600" aria-label="{{ _('admin_plans.modal_close_aria') }}">
           <i class="fas fa-times" aria-hidden="true"></i>
         </button>
       </div>
@@ -205,66 +203,66 @@
 
         <!-- Basic Info -->
         <div class="px-6 py-5 space-y-4">
-          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">Basic Info</h3>
+          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">{{ _("admin_plans.section_basic_info") }}</h3>
           <div class="grid grid-cols-2 gap-4">
             <div>
-              <label for="f-name" class="block text-sm font-medium text-gray-700 mb-1">Name <span class="text-red-500" aria-hidden="true">*</span></label>
+              <label for="f-name" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_name") }} <span class="text-red-500" aria-hidden="true">*</span></label>
               <input id="f-name" type="text" x-model="form.name" required
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div>
-              <label for="f-plan-id" class="block text-sm font-medium text-gray-700 mb-1">Plan ID <span class="text-red-500" aria-hidden="true">*</span></label>
+              <label for="f-plan-id" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_plan_id") }} <span class="text-red-500" aria-hidden="true">*</span></label>
               <input id="f-plan-id" type="text" x-model="form.plan_id" :readonly="!isCreate"
                 :class="!isCreate ? 'bg-gray-50 text-gray-400 cursor-not-allowed' : ''"
                 required pattern="[a-z0-9_-]+" title="Lowercase letters, numbers, _ and - only"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
-              <p class="text-xs text-gray-400 mt-0.5">Lowercase slug, cannot be changed after creation.</p>
+              <p class="text-xs text-gray-400 mt-0.5">{{ _("admin_plans.hint_plan_id") }}</p>
             </div>
           </div>
           <div>
-            <label for="f-tagline" class="block text-sm font-medium text-gray-700 mb-1">Tagline</label>
+            <label for="f-tagline" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_tagline") }}</label>
             <input id="f-tagline" type="text" x-model="form.tagline" maxlength="255"
               class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
           </div>
           <div class="grid grid-cols-3 gap-4">
             <div>
-              <label for="f-sort-order" class="block text-sm font-medium text-gray-700 mb-1">Sort Order</label>
+              <label for="f-sort-order" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_sort_order") }}</label>
               <input id="f-sort-order" type="number" x-model.number="form.sort_order" min="0"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div class="flex items-center gap-3 pt-6">
               <input id="f-active" type="checkbox" x-model="form.is_active"
                 class="h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500" />
-              <label for="f-active" class="text-sm font-medium text-gray-700">Active</label>
+              <label for="f-active" class="text-sm font-medium text-gray-700">{{ _("admin_plans.field_active") }}</label>
             </div>
             <div class="flex items-center gap-3 pt-6">
               <input id="f-highlighted" type="checkbox" x-model="form.is_highlighted"
                 class="h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500" />
-              <label for="f-highlighted" class="text-sm font-medium text-gray-700">Featured / Highlighted</label>
+              <label for="f-highlighted" class="text-sm font-medium text-gray-700">{{ _("admin_plans.field_featured") }}</label>
             </div>
           </div>
         </div>
 
         <!-- Pricing -->
         <div class="px-6 py-5 space-y-4">
-          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">Pricing</h3>
+          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">{{ _("admin_plans.section_pricing") }}</h3>
           <div class="grid grid-cols-3 gap-4">
             <div>
-              <label for="f-price-monthly" class="block text-sm font-medium text-gray-700 mb-1">Monthly Price ($)</label>
+              <label for="f-price-monthly" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_price_monthly") }}</label>
               <input id="f-price-monthly" type="number" x-model.number="form.price_monthly" min="0" step="0.01"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div>
-              <label for="f-price-yearly" class="block text-sm font-medium text-gray-700 mb-1">Yearly Price ($)</label>
+              <label for="f-price-yearly" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_price_yearly") }}</label>
               <input id="f-price-yearly" type="number" x-model.number="form.price_yearly" min="0" step="0.01"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
               <p class="text-xs mt-0.5"
                 :class="yearlySavingPct > 0 ? 'text-green-600 font-medium' : 'text-gray-400'"
-                x-text="yearlySavingPct > 0 ? 'Save ' + yearlySavingPct.toFixed(0) + '% vs monthly' : 'Enter yearly price to show savings'">
+                x-text="yearlySavingPct > 0 ? i18n.yearlySave.replace('{pct}', yearlySavingPct.toFixed(0)) : i18n.yearlyEnter">
               </p>
             </div>
             <div>
-              <label for="f-trial-days" class="block text-sm font-medium text-gray-700 mb-1">Trial Days</label>
+              <label for="f-trial-days" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_trial_days") }}</label>
               <input id="f-trial-days" type="number" x-model.number="form.trial_days" min="0"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
@@ -274,21 +272,21 @@
         <!-- Stripe Integration -->
         <div class="px-6 py-5 space-y-4">
           <div class="flex items-center justify-between">
-            <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">Stripe Integration</h3>
+            <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">{{ _("admin_plans.section_stripe") }}</h3>
             <a href="/admin/stripe-wizard" target="_blank"
                class="text-xs text-indigo-600 hover:text-indigo-800 font-medium focus:outline-none focus:ring-1 focus:ring-indigo-400 rounded"
-               aria-label="Open Stripe Setup Wizard in a new tab"
-            ><i class="fab fa-stripe mr-1" aria-hidden="true"></i>Stripe Wizard</a>
+               aria-label="{{ _('admin_plans.stripe_wizard_aria') }}"
+            ><i class="fab fa-stripe mr-1" aria-hidden="true"></i>{{ _("admin_plans.stripe_wizard_link") }}</a>
           </div>
           <p class="text-xs text-gray-500">
-            Enter the Stripe Price IDs for this plan, or use the
-            <a href="/admin/stripe-wizard" target="_blank" class="text-indigo-600 hover:text-indigo-800 underline">Stripe Setup Wizard</a>
-            to auto-create them. Free plans do not need Stripe Price IDs.
+            {{ _("admin_plans.stripe_desc_before") }}
+            <a href="/admin/stripe-wizard" target="_blank" class="text-indigo-600 hover:text-indigo-800 underline">{{ _("admin_plans.stripe_wizard_text") }}</a>
+            {{ _("admin_plans.stripe_desc_after") }}
           </p>
           <div class="grid grid-cols-2 gap-4">
             <div>
               <label for="f-stripe-monthly" class="block text-sm font-medium text-gray-700 mb-1">
-                Stripe Price ID (monthly)
+                {{ _("admin_plans.field_stripe_monthly") }}
               </label>
               <input id="f-stripe-monthly" type="text" x-model="form.stripe_price_id_monthly"
                 placeholder="price_1OtAbc…"
@@ -296,7 +294,7 @@
             </div>
             <div>
               <label for="f-stripe-yearly" class="block text-sm font-medium text-gray-700 mb-1">
-                Stripe Price ID (yearly)
+                {{ _("admin_plans.field_stripe_yearly") }}
               </label>
               <input id="f-stripe-yearly" type="text" x-model="form.stripe_price_id_yearly"
                 placeholder="price_1OtAbc… (optional)"
@@ -307,36 +305,36 @@
 
         <!-- Volume Limits -->
         <div class="px-6 py-5 space-y-4">
-          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">Volume Limits</h3>
-          <p class="text-xs text-gray-500">Enter <strong>0</strong> for unlimited.</p>
+          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">{{ _("admin_plans.section_volume") }}</h3>
+          <p class="text-xs text-gray-500">{{ _("admin_plans.hint_zero_unlimited") }}</p>
           <div class="grid grid-cols-3 gap-4">
             <div>
-              <label for="f-monthly-limit" class="block text-sm font-medium text-gray-700 mb-1">Docs / Month</label>
+              <label for="f-monthly-limit" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_docs_month") }}</label>
               <input id="f-monthly-limit" type="number" x-model.number="form.monthly_upload_limit" min="0"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div>
-              <label for="f-lifetime-limit" class="block text-sm font-medium text-gray-700 mb-1">Lifetime Docs</label>
+              <label for="f-lifetime-limit" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_lifetime_docs") }}</label>
               <input id="f-lifetime-limit" type="number" x-model.number="form.lifetime_file_limit" min="0"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div>
-              <label for="f-ocr-pages" class="block text-sm font-medium text-gray-700 mb-1">OCR Pages / Month</label>
+              <label for="f-ocr-pages" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_ocr_pages") }}</label>
               <input id="f-ocr-pages" type="number" x-model.number="form.max_ocr_pages_monthly" min="0"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div>
-              <label for="f-dests" class="block text-sm font-medium text-gray-700 mb-1">Storage Destinations</label>
+              <label for="f-dests" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_storage_dests") }}</label>
               <input id="f-dests" type="number" x-model.number="form.max_storage_destinations" min="0"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div>
-              <label for="f-mailboxes" class="block text-sm font-medium text-gray-700 mb-1">Email Mailboxes</label>
+              <label for="f-mailboxes" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_mailboxes") }}</label>
               <input id="f-mailboxes" type="number" x-model.number="form.max_mailboxes" min="0"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div>
-              <label for="f-filesize" class="block text-sm font-medium text-gray-700 mb-1">Max File Size (MB)</label>
+              <label for="f-filesize" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_max_file_size") }}</label>
               <input id="f-filesize" type="number" x-model.number="form.max_file_size_mb" min="0"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
@@ -345,15 +343,15 @@
 
         <!-- Overage Designer -->
         <div class="px-6 py-5 space-y-4">
-          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">Overage Designer</h3>
+          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">{{ _("admin_plans.section_overage") }}</h3>
           <div>
             <label for="f-overage-pct" class="block text-sm font-medium text-gray-700 mb-2">
-              Buffer:
+              {{ _("admin_plans.field_buffer") }}
               <span class="text-indigo-700 font-semibold" x-text="form.overage_percent + '%'"></span>
               <template x-if="form.monthly_upload_limit > 0">
                 <span class="text-gray-500 font-normal ml-2">
-                  → announce <strong x-text="form.monthly_upload_limit"></strong> docs,
-                  enforce at <strong class="text-indigo-700" x-text="Math.round(form.monthly_upload_limit * (1 + form.overage_percent / 100))"></strong> docs
+                  {{ _("admin_plans.overage_announce") }} <strong x-text="form.monthly_upload_limit"></strong> {{ _("admin_plans.overage_docs") }}
+                  {{ _("admin_plans.overage_enforce_at") }} <strong class="text-indigo-700" x-text="Math.round(form.monthly_upload_limit * (1 + form.overage_percent / 100))"></strong> {{ _("admin_plans.overage_docs_end") }}
                 </span>
               </template>
             </label>
@@ -368,27 +366,27 @@
               aria-valuemax="100"
             />
             <div class="flex justify-between text-xs text-gray-400 mt-1">
-              <span>0% (exact)</span>
-              <span>50%</span>
-              <span>100%</span>
+              <span>{{ _("admin_plans.overage_0pct") }}</span>
+              <span>{{ _("admin_plans.overage_50pct") }}</span>
+              <span>{{ _("admin_plans.overage_100pct") }}</span>
             </div>
           </div>
           <div class="grid grid-cols-2 gap-4 opacity-60">
             <div class="relative">
-              <label class="block text-sm font-medium text-gray-700 mb-1">Allow Overage Billing</label>
+              <label class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_allow_overage") }}</label>
               <div class="flex items-center gap-2">
                 <input type="checkbox" disabled class="h-4 w-4 rounded border-gray-300 text-indigo-600" />
-                <span class="text-xs text-gray-400">Coming soon</span>
+                <span class="text-xs text-gray-400">{{ _("admin_plans.coming_soon") }}</span>
               </div>
             </div>
             <div class="relative">
-              <label class="block text-sm font-medium text-gray-700 mb-1">Overage price / doc ($)</label>
-              <input type="number" disabled placeholder="Coming soon"
+              <label class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_overage_doc_price") }}</label>
+              <input type="number" disabled placeholder="{{ _('admin_plans.coming_soon') }}"
                 class="w-full px-3 py-2 border border-gray-200 rounded-md text-sm bg-gray-50 text-gray-400 cursor-not-allowed" />
             </div>
             <div class="relative">
-              <label class="block text-sm font-medium text-gray-700 mb-1">Overage price / OCR page ($)</label>
-              <input type="number" disabled placeholder="Coming soon"
+              <label class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_overage_ocr_price") }}</label>
+              <input type="number" disabled placeholder="{{ _('admin_plans.coming_soon') }}"
                 class="w-full px-3 py-2 border border-gray-200 rounded-md text-sm bg-gray-50 text-gray-400 cursor-not-allowed" />
             </div>
           </div>
@@ -396,18 +394,18 @@
 
         <!-- Features -->
         <div class="px-6 py-5 space-y-3">
-          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">Features List</h3>
-          <p class="text-xs text-gray-500">These bullet points appear on the pricing page card for this plan.</p>
+          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">{{ _("admin_plans.section_features") }}</h3>
+          <p class="text-xs text-gray-500">{{ _("admin_plans.hint_features") }}</p>
           <template x-for="(feat, i) in form.features" :key="i">
             <div class="flex items-center gap-2">
               <input
                 type="text"
                 x-model="form.features[i]"
-                :aria-label="'Feature ' + (i+1)"
+                :aria-label="i18n.ariaFeatureN.replace('{n}', i + 1)"
                 class="flex-1 px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400"
               />
               <button type="button" @click="form.features.splice(i, 1)"
-                :aria-label="'Remove feature ' + (i+1)"
+                :aria-label="i18n.ariaRemoveFeatureN.replace('{n}', i + 1)"
                 class="text-red-400 hover:text-red-600 px-2 py-2">
                 <i class="fas fa-times" aria-hidden="true"></i>
               </button>
@@ -415,21 +413,21 @@
           </template>
           <button type="button" @click="form.features.push('')"
             class="inline-flex items-center text-sm text-indigo-600 hover:text-indigo-800 font-medium">
-            <i class="fas fa-plus mr-1" aria-hidden="true"></i> Add Feature
+            <i class="fas fa-plus mr-1" aria-hidden="true"></i> {{ _("admin_plans.btn_add_feature") }}
           </button>
         </div>
 
         <!-- Display -->
         <div class="px-6 py-5 space-y-4">
-          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">Display</h3>
+          <h3 class="text-sm font-semibold text-gray-700 uppercase tracking-wider">{{ _("admin_plans.section_display") }}</h3>
           <div class="grid grid-cols-2 gap-4">
             <div>
-              <label for="f-cta" class="block text-sm font-medium text-gray-700 mb-1">CTA Button Text</label>
+              <label for="f-cta" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_cta_text") }}</label>
               <input id="f-cta" type="text" x-model="form.cta_text" maxlength="100"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
             </div>
             <div>
-              <label for="f-badge" class="block text-sm font-medium text-gray-700 mb-1">Badge Text</label>
+              <label for="f-badge" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_plans.field_badge_text") }}</label>
               <input id="f-badge" type="text" x-model="form.badge_text" maxlength="50"
                 placeholder="e.g. Most Popular"
                 class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-indigo-400" />
@@ -438,7 +436,7 @@
           <div class="flex items-center gap-3">
             <input id="f-api" type="checkbox" x-model="form.api_access"
               class="h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500" />
-            <label for="f-api" class="text-sm font-medium text-gray-700">API Access</label>
+            <label for="f-api" class="text-sm font-medium text-gray-700">{{ _("admin_plans.field_api_access") }}</label>
           </div>
         </div>
 
@@ -449,15 +447,15 @@
             @click="modalOpen = false"
             class="px-4 py-2 text-sm font-medium border border-gray-300 rounded-md text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-gray-400"
           >
-            Cancel
+            {{ _("admin_plans.btn_cancel") }}
           </button>
           <button
             type="submit"
             :disabled="saving"
             class="px-4 py-2 text-sm font-medium rounded-md text-white bg-indigo-600 hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-indigo-500 disabled:opacity-50 disabled:cursor-not-allowed"
           >
-            <span x-show="!saving" x-text="isCreate ? 'Create Plan' : 'Save Changes'"></span>
-            <span x-show="saving"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Saving…</span>
+            <span x-show="!saving" x-text="isCreate ? i18n.btnCreate : i18n.btnSaveChanges"></span>
+            <span x-show="saving"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> <span x-text="i18n.btnSaving"></span></span>
           </button>
         </div>
 
@@ -467,9 +465,46 @@
 
 </main>
 
+<script>
+  window.__i18nAdminPlans = {
+    modalCreateTitle: {{ _("admin_plans.modal_create_title") | tojson }},
+    modalEditTitlePrefix: {{ _("admin_plans.modal_edit_title_prefix") | tojson }},
+    statusActive: {{ _("admin_plans.status_active") | tojson }},
+    statusInactive: {{ _("admin_plans.status_inactive") | tojson }},
+    featuredBadge: {{ _("admin_plans.featured_badge") | tojson }},
+    freeLabel: {{ _("admin_plans.free_label") | tojson }},
+    btnEdit: {{ _("admin_plans.btn_edit") | tojson }},
+    btnDelete: {{ _("admin_plans.btn_delete") | tojson }},
+    btnCreate: {{ _("admin_plans.btn_create") | tojson }},
+    btnSaveChanges: {{ _("admin_plans.btn_save_changes") | tojson }},
+    btnSaving: {{ _("admin_plans.btn_saving") | tojson }},
+    ariaMoveUp: {{ _("admin_plans.aria_move_up") | tojson }},
+    ariaMoveDown: {{ _("admin_plans.aria_move_down") | tojson }},
+    ariaEditPlan: {{ _("admin_plans.aria_edit_plan") | tojson }},
+    ariaDeletePlan: {{ _("admin_plans.aria_delete_plan") | tojson }},
+    ariaFeatureN: {{ _("admin_plans.aria_feature_n") | tojson }},
+    ariaRemoveFeatureN: {{ _("admin_plans.aria_remove_feature_n") | tojson }},
+    yearlySave: {{ _("admin_plans.js_yearly_save") | tojson }},
+    yearlyEnter: {{ _("admin_plans.js_yearly_enter") | tojson }},
+    jsFailedLoad: {{ _("admin_plans.js_failed_load") | tojson }},
+    jsPlanCreated: {{ _("admin_plans.js_plan_created") | tojson }},
+    jsPlanUpdated: {{ _("admin_plans.js_plan_updated") | tojson }},
+    jsDeleteConfirm: {{ _("admin_plans.js_delete_confirm") | tojson }},
+    jsDeleteFailed: {{ _("admin_plans.js_delete_failed") | tojson }},
+    jsPlanDeleted: {{ _("admin_plans.js_plan_deleted") | tojson }},
+    jsSeedConfirm: {{ _("admin_plans.js_seed_confirm") | tojson }},
+    jsSeedFailed: {{ _("admin_plans.js_seed_failed") | tojson }},
+    jsReorderFailed: {{ _("admin_plans.js_reorder_failed") | tojson }},
+    jsOrderSaved: {{ _("admin_plans.js_order_saved") | tojson }},
+    jsSaveFailed: {{ _("admin_plans.js_save_failed") | tojson }},
+  };
+</script>
+
 <script>
 function planDesigner() {
+  const i18n = window.__i18nAdminPlans;
   return {
+    i18n,
     plans: [],
     loading: true,
     saving: false,
@@ -524,7 +559,7 @@ function planDesigner() {
       this.errorMsg = '';
       try {
         const resp = await fetch('/api/plans/admin');
-        if (!resp.ok) throw new Error('Failed to load plans');
+        if (!resp.ok) throw new Error(i18n.jsFailedLoad);
         const data = await resp.json();
         this.plans = data.plans || [];
       } catch (e) {
@@ -568,9 +603,9 @@ function planDesigner() {
         });
         if (!resp.ok) {
           const err = await resp.json().catch(() => ({ detail: resp.statusText }));
-          throw new Error(err.detail || 'Save failed');
+          throw new Error(err.detail || i18n.jsSaveFailed);
         }
-        this.successMsg = this.isCreate ? 'Plan created!' : 'Plan updated!';
+        this.successMsg = this.isCreate ? i18n.jsPlanCreated : i18n.jsPlanUpdated;
         this.modalOpen = false;
         await this.loadPlans();
       } catch (e) {
@@ -581,15 +616,15 @@ function planDesigner() {
     },
 
     async deletePlan(planId) {
-      if (!confirm(`Delete plan "${planId}"? This cannot be undone.`)) return;
+      if (!confirm(i18n.jsDeleteConfirm.replace('{id}', planId))) return;
       this.errorMsg = '';
       try {
         const resp = await fetch(`/api/plans/${encodeURIComponent(planId)}`, { method: 'DELETE' });
         if (!resp.ok && resp.status !== 204) {
           const err = await resp.json().catch(() => ({ detail: resp.statusText }));
-          throw new Error(err.detail || 'Delete failed');
+          throw new Error(err.detail || i18n.jsDeleteFailed);
         }
-        this.successMsg = `Plan "${planId}" deleted.`;
+        this.successMsg = i18n.jsPlanDeleted.replace('{id}', planId);
         await this.loadPlans();
       } catch (e) {
         this.errorMsg = e.message;
@@ -597,12 +632,12 @@ function planDesigner() {
     },
 
     async seedDefaults() {
-      if (!confirm('Seed the four default plans? This is a no-op if plans already exist.')) return;
+      if (!confirm(i18n.jsSeedConfirm)) return;
       this.seeding = true;
       this.errorMsg = '';
       try {
         const resp = await fetch('/api/plans/seed', { method: 'POST' });
-        if (!resp.ok) throw new Error('Seed failed');
+        if (!resp.ok) throw new Error(i18n.jsSeedFailed);
         const data = await resp.json();
         this.successMsg = data.message;
         await this.loadPlans();
@@ -635,8 +670,8 @@ function planDesigner() {
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ order }),
         });
-        if (!resp.ok) throw new Error('Reorder failed');
-        this.successMsg = 'Order saved!';
+        if (!resp.ok) throw new Error(i18n.jsReorderFailed);
+        this.successMsg = i18n.jsOrderSaved;
         this.orderDirty = false;
       } catch (e) {
         this.errorMsg = e.message;

frontend/templates/admin_users.html

@@ -1,5 +1,5 @@
 {% extends "base.html" %}
-{% block title %}User Management – Admin – DocuElevate{% endblock %}
+{% block title %}{{ _("admin_users.page_title") }}{% endblock %}
 
 {% block content %}
 <div class="container mx-auto px-4 py-8" x-data="adminUsersApp()">
@@ -9,11 +9,11 @@
     <div>
       <h1 class="text-3xl font-bold text-gray-900 flex items-center gap-2">
         <i class="fas fa-users text-blue-500" aria-hidden="true"></i>
-        User Management
-        <span class="text-xs font-semibold text-red-600 bg-red-50 border border-red-200 rounded px-2 py-0.5 ml-1">Admin Only</span>
+        {{ _("admin_users.heading") }}
+        <span class="text-xs font-semibold text-red-600 bg-red-50 border border-red-200 rounded px-2 py-0.5 ml-1">{{ _("admin_users.admin_only_badge") }}</span>
       </h1>
       <p class="text-gray-500 text-sm mt-1">
-        Manage user profiles, per-user upload limits, and document ownership.
+        {{ _("admin_users.subheading") }}
       </p>
     </div>
     <button
@@ -21,14 +21,14 @@
       @click="openCreateModal()"
       class="inline-flex items-center px-4 py-2 bg-blue-600 hover:bg-blue-700 text-white text-sm font-medium rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-blue-500"
     >
-      <i class="fas fa-user-plus mr-2" aria-hidden="true"></i> Add User Profile
+      <i class="fas fa-user-plus mr-2" aria-hidden="true"></i> {{ _("admin_users.add_user_profile_btn") }}
     </button>
     <button
       type="button"
       @click="openCreateLocalUserModal()"
       class="inline-flex items-center px-4 py-2 bg-green-600 hover:bg-green-700 text-white text-sm font-medium rounded-md shadow-sm focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-green-500"
     >
-      <i class="fas fa-user-lock mr-2" aria-hidden="true"></i> Create Local Account
+      <i class="fas fa-user-lock mr-2" aria-hidden="true"></i> {{ _("admin_users.create_local_account_btn") }}
     </button>
   </div>
 
@@ -48,7 +48,7 @@
   <!-- ── Search & pagination controls ──────────────────────────────────────── -->
   <div class="mb-4 flex flex-col sm:flex-row gap-3 items-start sm:items-center justify-between">
     <div class="flex-1 max-w-sm">
-      <label for="userSearch" class="sr-only">Search users</label>
+      <label for="userSearch" class="sr-only">{{ _("admin_users.search_users_label") }}</label>
       <div class="relative">
         <span class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
           <i class="fas fa-search text-gray-400 text-sm" aria-hidden="true"></i>
@@ -58,7 +58,7 @@
           type="search"
           x-model="search"
           @input.debounce.300ms="fetchUsers(1)"
-          placeholder="Filter by user ID…"
+          placeholder="{{ _('admin_users.filter_placeholder') }}"
           class="w-full pl-9 pr-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-400"
         />
       </div>
@@ -68,24 +68,24 @@
 
   <!-- ── Table ──────────────────────────────────────────────────────────────── -->
   <div class="bg-white shadow rounded-lg overflow-x-auto">
-    <table class="min-w-full divide-y divide-gray-200" aria-label="User list">
+    <table class="min-w-full divide-y divide-gray-200" aria-label="{{ _('admin_users.heading') }}">
       <thead class="bg-gray-50">
         <tr>
-          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">User ID</th>
-          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Display Name</th>
-          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">Documents</th>
-          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Last Upload</th>
-          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">Plan</th>
-          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">Upload Limit</th>
-          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">Status</th>
-          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">Actions</th>
+          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_user_id") }}</th>
+          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_display_name") }}</th>
+          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_documents") }}</th>
+          <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_last_upload") }}</th>
+          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_plan") }}</th>
+          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_upload_limit") }}</th>
+          <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("common.status") }}</th>
+          <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("common.actions") }}</th>
         </tr>
       </thead>
       <tbody class="bg-white divide-y divide-gray-200">
         <template x-if="loading">
           <tr>
             <td colspan="8" class="px-4 py-8 text-center text-gray-400">
-              <i class="fas fa-spinner fa-spin mr-2" aria-hidden="true"></i> Loading users…
+              <i class="fas fa-spinner fa-spin mr-2" aria-hidden="true"></i> {{ _("admin_users.loading_users") }}
             </td>
           </tr>
         </template>
@@ -93,9 +93,9 @@
           <tr>
             <td colspan="8" class="px-4 py-8 text-center text-gray-400">
               <i class="fas fa-users-slash text-3xl block mb-2" aria-hidden="true"></i>
-              No users found.
-              <span x-show="search"> Try a different search term.</span>
-              <span x-show="!search"> Upload some documents or add a profile above.</span>
+              {{ _("admin_users.no_users_found") }}
+              <span x-show="search"> {{ _("admin_users.no_users_search_hint") }}</span>
+              <span x-show="!search"> {{ _("admin_users.no_users_add_hint") }}</span>
             </td>
           </tr>
         </template>
@@ -159,9 +159,9 @@
             <td class="px-4 py-3 text-sm text-center text-gray-700">
               <span x-show="user.daily_upload_limit !== null && user.daily_upload_limit !== undefined"
                     class="inline-flex items-center px-2 py-0.5 rounded-full text-xs font-medium bg-indigo-100 text-indigo-700"
-                    x-text="user.daily_upload_limit + ' / day'"></span>
+                    x-text="user.daily_upload_limit + ' {{ _("admin_users.per_day") }}'"></span>
               <span x-show="user.daily_upload_limit === null || user.daily_upload_limit === undefined"
-                    class="text-gray-400 text-xs">global default</span>
+                    class="text-gray-400 text-xs">{{ _("admin_users.global_default") }}</span>
             </td>
             <!-- Status -->
             <td class="px-4 py-3 text-sm text-center">
@@ -172,7 +172,7 @@
                 class="inline-flex items-center gap-1 px-2 py-0.5 rounded-full text-xs font-medium"
               >
                 <i :class="user.is_blocked ? 'fas fa-ban' : 'fas fa-check-circle'" aria-hidden="true"></i>
-                <span x-text="user.is_blocked ? 'Blocked' : 'Active'"></span>
+                <span x-text="user.is_blocked ? '{{ _("admin_users.status_blocked") }}' : '{{ _("common.active") }}'"></span>
               </span>
             </td>
             <!-- Actions -->
@@ -181,18 +181,18 @@
                 type="button"
                 @click="openEditModal(user)"
                 class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded border border-gray-300 text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-blue-500 mr-1"
-                :aria-label="`Edit profile for ${user.user_id}`"
+                :aria-label="`{{ _('common.edit') }} ${user.user_id}`"
               >
-                <i class="fas fa-edit mr-1" aria-hidden="true"></i> Edit
+                <i class="fas fa-edit mr-1" aria-hidden="true"></i> {{ _("common.edit") }}
               </button>
               <button
                 type="button"
                 @click="confirmDelete(user)"
                 x-show="user.profile_id !== null"
                 class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded border border-red-300 text-red-600 bg-white hover:bg-red-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-red-400"
-                :aria-label="`Delete profile for ${user.user_id}`"
+                :aria-label="`{{ _('common.delete') }} ${user.user_id}`"
               >
-                <i class="fas fa-trash mr-1" aria-hidden="true"></i> Delete
+                <i class="fas fa-trash mr-1" aria-hidden="true"></i> {{ _("common.delete") }}
               </button>
             </td>
           </tr>
@@ -209,10 +209,10 @@
       :disabled="currentPage <= 1"
       class="px-3 py-1.5 text-sm border border-gray-300 rounded hover:bg-gray-50 disabled:opacity-40 disabled:cursor-not-allowed"
     >
-      <i class="fas fa-chevron-left mr-1" aria-hidden="true"></i> Previous
+      <i class="fas fa-chevron-left mr-1" aria-hidden="true"></i> {{ _("common.previous") }}
     </button>
     <span class="text-sm text-gray-500">
-      Page <span x-text="currentPage"></span> of <span x-text="pages"></span>
+      {{ _("common.page") }} <span x-text="currentPage"></span> {{ _("admin_users.pagination_page_of") }} <span x-text="pages"></span>
     </span>
     <button
       type="button"
@@ -220,7 +220,7 @@
       :disabled="currentPage >= pages"
       class="px-3 py-1.5 text-sm border border-gray-300 rounded hover:bg-gray-50 disabled:opacity-40 disabled:cursor-not-allowed"
     >
-      Next <i class="fas fa-chevron-right ml-1" aria-hidden="true"></i>
+      {{ _("common.next") }} <i class="fas fa-chevron-right ml-1" aria-hidden="true"></i>
     </button>
   </div>
 
@@ -250,7 +250,7 @@
           type="button"
           @click="modalOpen = false"
           class="text-gray-400 hover:text-gray-600 focus:outline-none"
-          aria-label="Close dialog"
+          aria-label="{{ _('admin_users.modal_close_aria') }}"
         >
           <i class="fas fa-times" aria-hidden="true"></i>
         </button>
@@ -261,7 +261,7 @@
 
           <!-- User ID (read-only when editing) -->
           <div>
-            <label for="modal-user-id" class="block text-sm font-medium text-gray-700 mb-1">User ID</label>
+            <label for="modal-user-id" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_users.modal_user_id_label") }}</label>
             <input
               id="modal-user-id"
               type="text"
@@ -269,32 +269,32 @@
               :readonly="!isCreate"
               :class="!isCreate ? 'bg-gray-100 cursor-not-allowed' : ''"
               class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-400"
-              placeholder="user@example.com or OAuth sub"
+              placeholder="{{ _('admin_users.modal_user_id_placeholder') }}"
               required
               aria-required="true"
               autocomplete="off"
             />
-            <p class="text-xs text-gray-400 mt-1">The stable identifier that matches <code>owner_id</code> in documents.</p>
+            <p class="text-xs text-gray-400 mt-1">{{ _("admin_users.modal_user_id_hint") }}</p>
           </div>
 
           <!-- Display name -->
           <div>
-            <label for="modal-display-name" class="block text-sm font-medium text-gray-700 mb-1">Display Name</label>
+            <label for="modal-display-name" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_users.modal_display_name_label") }}</label>
             <input
               id="modal-display-name"
               type="text"
               x-model="form.display_name"
               maxlength="255"
               class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-400"
-              placeholder="Alice Smith (optional)"
+              placeholder="{{ _('admin_users.modal_display_name_placeholder') }}"
             />
           </div>
 
           <!-- Daily upload limit -->
           <div>
             <label for="modal-limit" class="block text-sm font-medium text-gray-700 mb-1">
-              Daily Upload Limit
-              <span class="ml-1 text-xs font-normal text-gray-400">(leave empty to use global default)</span>
+              {{ _("admin_users.modal_daily_limit_label") }}
+              <span class="ml-1 text-xs font-normal text-gray-400">{{ _("admin_users.modal_daily_limit_hint") }}</span>
             </label>
             <input
               id="modal-limit"
@@ -302,20 +302,20 @@
               x-model.number="form.daily_upload_limit"
               min="0"
               class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-400"
-              placeholder="e.g. 50  (0 = unlimited)"
+              placeholder="{{ _('admin_users.modal_daily_limit_placeholder') }}"
             />
           </div>
 
           <!-- Notes -->
           <div>
-            <label for="modal-notes" class="block text-sm font-medium text-gray-700 mb-1">Admin Notes</label>
+            <label for="modal-notes" class="block text-sm font-medium text-gray-700 mb-1">{{ _("admin_users.modal_notes_label") }}</label>
             <textarea
               id="modal-notes"
               x-model="form.notes"
               rows="3"
               maxlength="4096"
               class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-400 resize-y"
-              placeholder="Internal notes visible only to admins…"
+              placeholder="{{ _('admin_users.modal_notes_placeholder') }}"
             ></textarea>
           </div>
 
@@ -336,50 +336,50 @@
               ></span>
             </button>
             <span id="modal-blocked-label" class="text-sm font-medium text-gray-700">
-              Block this user
-              <span class="text-xs text-gray-400 font-normal">(prevents new document uploads)</span>
+              {{ _("admin_users.modal_block_label") }}
+              <span class="text-xs text-gray-400 font-normal">{{ _("admin_users.modal_block_hint") }}</span>
             </span>
           </div>
 
           <!-- Subscription tier -->
           <div>
             <label for="modal-tier" class="block text-sm font-medium text-gray-700 mb-1">
-              Subscription Plan
+              {{ _("admin_users.modal_plan_label") }}
             </label>
             <select
               id="modal-tier"
               x-model="form.subscription_tier"
               class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-400 bg-white"
             >
-              <option value="free">Free — 25 lifetime files</option>
-              <option value="starter">Starter — $2.99/mo (50/mo, 1 mailbox)</option>
-              <option value="professional">Professional — $5.99/mo (150/mo, 3 mailboxes)</option>
-              <option value="business">Business — $7.99/mo (300/mo, unlimited mailboxes)</option>
+              <option value="free">{{ _("admin_users.modal_plan_free") }}</option>
+              <option value="starter">{{ _("admin_users.modal_plan_starter") }}</option>
+              <option value="professional">{{ _("admin_users.modal_plan_professional") }}</option>
+              <option value="business">{{ _("admin_users.modal_plan_business") }}</option>
             </select>
             <p class="text-xs text-gray-400 mt-1">
-              Sets the quota limits for this user. Limits are enforced on upload.
+              {{ _("admin_users.modal_plan_hint") }}
             </p>
           </div>
 
           <!-- Billing cycle -->
           <div>
             <label for="modal-billing-cycle" class="block text-sm font-medium text-gray-700 mb-1">
-              Billing Cycle
+              {{ _("admin_users.modal_billing_cycle_label") }}
             </label>
             <select
               id="modal-billing-cycle"
               x-model="form.subscription_billing_cycle"
               class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-400 bg-white"
             >
-              <option value="monthly">Monthly</option>
-              <option value="yearly">Yearly</option>
+              <option value="monthly">{{ _("admin_users.modal_billing_monthly") }}</option>
+              <option value="yearly">{{ _("admin_users.modal_billing_yearly") }}</option>
             </select>
           </div>
 
           <!-- Subscription period start (only shown for yearly) -->
           <div x-show="form.subscription_billing_cycle === 'yearly'" x-cloak>
             <label for="modal-period-start" class="block text-sm font-medium text-gray-700 mb-1">
-              Subscription Period Start
+              {{ _("admin_users.modal_period_start_label") }}
             </label>
             <input
               type="date"
@@ -388,7 +388,7 @@
               class="w-full px-3 py-2 border border-gray-300 rounded-md text-sm focus:outline-none focus:ring-2 focus:ring-blue-400"
             />
             <p class="text-xs text-gray-400 mt-1">
-              Annual carry-over calculates from this date. Leave blank for monthly enforcement.
+              {{ _("admin_users.modal_period_start_hint") }}
             </p>
           </div>
 
@@ -409,8 +409,8 @@
               ></span>
             </button>
             <span id="modal-complimentary-label" class="text-sm font-medium text-gray-700">
-              Complimentary plan
-              <span class="text-xs text-gray-400 font-normal">(user keeps tier benefits but is never billed — set automatically for admin accounts)</span>
+              {{ _("admin_users.modal_complimentary_label") }}
+              <span class="text-xs text-gray-400 font-normal">{{ _("admin_users.modal_complimentary_hint") }}</span>
             </span>
           </div>
 
@@ -423,15 +423,15 @@
             @click="modalOpen = false"
             class="px-4 py-2 text-sm font-medium border border-gray-300 rounded-md text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-gray-400"
           >
-            Cancel
+            {{ _("common.cancel") }}
           </button>
           <button
             type="submit"
             :disabled="saving"
             class="px-4 py-2 text-sm font-medium rounded-md text-white bg-blue-600 hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-blue-500 disabled:opacity-50 disabled:cursor-not-allowed"
           >
-            <span x-show="!saving" x-text="isCreate ? 'Create' : 'Save Changes'"></span>
-            <span x-show="saving"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Saving…</span>
+            <span x-show="!saving" x-text="isCreate ? '{{ _('common.create') }}' : '{{ _('admin_users.modal_save_changes') }}'"></span>
+            <span x-show="saving"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> {{ _("admin_users.modal_saving") }}</span>
           </button>
         </div>
       </form>
@@ -444,10 +444,10 @@
       <div>
         <h2 class="text-lg font-semibold text-gray-900 flex items-center gap-2">
           <i class="fas fa-user-lock text-green-600" aria-hidden="true"></i>
-          Local User Accounts
+          {{ _("admin_users.local_accounts_heading") }}
         </h2>
         <p class="text-sm text-gray-500 mt-0.5">
-          Email/password accounts created directly on this server.
+          {{ _("admin_users.local_accounts_subheading") }}
         </p>
       </div>
       <button
@@ -455,35 +455,35 @@
         @click="openCreateLocalUserModal()"
         class="inline-flex items-center px-3 py-1.5 bg-green-600 hover:bg-green-700 text-white text-sm font-medium rounded-md focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-green-500"
       >
-        <i class="fas fa-plus mr-1" aria-hidden="true"></i> New Account
+        <i class="fas fa-plus mr-1" aria-hidden="true"></i> {{ _("admin_users.new_account_btn") }}
       </button>
     </div>
     <div class="overflow-x-auto">
-      <table class="min-w-full divide-y divide-gray-200" aria-label="Local user accounts">
+      <table class="min-w-full divide-y divide-gray-200" aria-label="{{ _('admin_users.local_accounts_heading') }}">
         <thead class="bg-gray-50">
           <tr>
-            <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Username</th>
-            <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Email</th>
-            <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Display Name</th>
-            <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">Status</th>
-            <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">Role</th>
-            <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Created</th>
-            <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">Actions</th>
+            <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_username") }}</th>
+            <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_email") }}</th>
+            <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_display_name") }}</th>
+            <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("common.status") }}</th>
+            <th scope="col" class="px-4 py-3 text-center text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("admin_users.col_role") }}</th>
+            <th scope="col" class="px-4 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("common.created") }}</th>
+            <th scope="col" class="px-4 py-3 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">{{ _("common.actions") }}</th>
           </tr>
         </thead>
         <tbody class="bg-white divide-y divide-gray-200">
           <template x-if="localUsersLoading">
             <tr>
               <td colspan="7" class="px-4 py-6 text-center text-gray-400">
-                <i class="fas fa-spinner fa-spin mr-2" aria-hidden="true"></i> Loading…
+                <i class="fas fa-spinner fa-spin mr-2" aria-hidden="true"></i> {{ _("admin_users.local_loading") }}
               </td>
             </tr>
           </template>
           <template x-if="!localUsersLoading && localUsers.length === 0">
             <tr>
               <td colspan="7" class="px-4 py-6 text-center text-gray-400">
-                No local accounts yet.
-                <button type="button" @click="openCreateLocalUserModal()" class="text-green-600 hover:underline ml-1">Create one.</button>
+                {{ _("admin_users.local_no_accounts") }}
+                <button type="button" @click="openCreateLocalUserModal()" class="text-green-600 hover:underline ml-1">{{ _("admin_users.local_create_one") }}</button>
               </td>
             </tr>
           </template>
@@ -496,14 +496,14 @@
                 <span
                   :class="lu.is_active ? 'bg-green-100 text-green-800' : 'bg-yellow-100 text-yellow-800'"
                   class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium"
-                  x-text="lu.is_active ? 'Active' : 'Unverified'"
+                  x-text="lu.is_active ? '{{ _("common.active") }}' : '{{ _("admin_users.status_unverified") }}'"
                 ></span>
               </td>
               <td class="px-4 py-3 text-sm text-center">
                 <span
                   :class="lu.is_admin ? 'bg-red-100 text-red-700' : 'bg-gray-100 text-gray-600'"
                   class="inline-flex items-center px-2 py-0.5 rounded text-xs font-medium"
-                  x-text="lu.is_admin ? 'Admin' : 'User'"
+                  x-text="lu.is_admin ? '{{ _("admin_users.role_admin") }}' : '{{ _("admin_users.role_user") }}'"
                 ></span>
               </td>
               <td class="px-4 py-3 text-sm text-gray-500 whitespace-nowrap" x-text="lu.created_at ? formatDate(lu.created_at) : '—'"></td>
@@ -512,34 +512,34 @@
                   type="button"
                   @click="openEditLocalUserModal(lu)"
                   class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded border border-gray-300 text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-blue-500 mr-1"
-                  :aria-label="`Edit account for ${lu.username}`"
+                  :aria-label="`{{ _('common.edit') }} ${lu.username}`"
                 >
-                  <i class="fas fa-edit mr-1" aria-hidden="true"></i> Edit
+                  <i class="fas fa-edit mr-1" aria-hidden="true"></i> {{ _("common.edit") }}
                 </button>
                 <button
                   type="button"
                   @click="openSetPasswordModal(lu)"
                   class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded border border-yellow-300 text-yellow-700 bg-white hover:bg-yellow-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-yellow-400 mr-1"
-                  :aria-label="`Set password for ${lu.username}`"
+                  :aria-label="`{{ _('admin_users.btn_password') }} ${lu.username}`"
                 >
-                  <i class="fas fa-key mr-1" aria-hidden="true"></i> Password
+                  <i class="fas fa-key mr-1" aria-hidden="true"></i> {{ _("admin_users.btn_password") }}
                 </button>
                 <button
                   type="button"
                   @click="sendPasswordReset(lu)"
                   class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded border border-indigo-300 text-indigo-600 bg-white hover:bg-indigo-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-indigo-400 mr-1"
-                  :aria-label="`Send password reset email to ${lu.username}`"
-                  title="Send password reset email"
+                  :aria-label="`{{ _('admin_users.btn_reset') }} ${lu.username}`"
+                  title="{{ _('admin_users.btn_reset') }}"
                 >
-                  <i class="fas fa-envelope mr-1" aria-hidden="true"></i> Reset
+                  <i class="fas fa-envelope mr-1" aria-hidden="true"></i> {{ _("admin_users.btn_reset") }}
                 </button>
                 <button
                   type="button"
                   @click="confirmDeleteLocalUser(lu)"
                   class="inline-flex items-center px-2.5 py-1.5 text-xs font-medium rounded border border-red-300 text-red-600 bg-white hover:bg-red-50 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-red-400"
-                  :aria-label="`Delete account for ${lu.username}`"
+                  :aria-label="`{{ _('common.delete') }} ${lu.username}`"
                 >
-                  <i class="fas fa-trash mr-1" aria-hidden="true"></i> Delete
+                  <i class="fas fa-trash mr-1" aria-hidden="true"></i> {{ _("common.delete") }}
                 </button>
               </td>
             </tr>
@@ -562,44 +562,44 @@
   >
     <div class="bg-white rounded-lg shadow-xl w-full max-w-lg" @click.outside="localUserModal.open = false">
       <div class="px-6 py-4 border-b flex items-center justify-between">
-        <h2 id="create-local-user-title" class="text-lg font-semibold text-gray-900">Create Local Account</h2>
-        <button type="button" @click="localUserModal.open = false" aria-label="Close" class="text-gray-400 hover:text-gray-600">
+        <h2 id="create-local-user-title" class="text-lg font-semibold text-gray-900">{{ _("admin_users.create_local_title") }}</h2>
+        <button type="button" @click="localUserModal.open = false" aria-label="{{ _('common.close') }}" class="text-gray-400 hover:text-gray-600">
           <i class="fas fa-times" aria-hidden="true"></i>
         </button>
       </div>
       <form @submit.prevent="submitCreateLocalUser" class="px-6 py-5 space-y-4">
         <div>
-          <label for="lu-email" class="block text-sm font-medium text-gray-700">Email <span aria-hidden="true" class="text-red-500">*</span></label>
+          <label for="lu-email" class="block text-sm font-medium text-gray-700">{{ _("admin_users.col_email") }} <span aria-hidden="true" class="text-red-500">*</span></label>
           <input type="email" id="lu-email" x-model="localUserModal.form.email" required autocomplete="off"
             class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-green-500 focus:ring focus:ring-green-500 focus:ring-opacity-50 text-sm"
             style="min-height:40px;" aria-required="true">
         </div>
         <div>
-          <label for="lu-username" class="block text-sm font-medium text-gray-700">Username <span aria-hidden="true" class="text-red-500">*</span></label>
+          <label for="lu-username" class="block text-sm font-medium text-gray-700">{{ _("admin_users.col_username") }} <span aria-hidden="true" class="text-red-500">*</span></label>
           <input type="text" id="lu-username" x-model="localUserModal.form.username" required autocomplete="off"
             pattern="^[a-zA-Z0-9_-]+$" minlength="3" maxlength="64"
             class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-green-500 focus:ring focus:ring-green-500 focus:ring-opacity-50 text-sm"
             style="min-height:40px;" aria-required="true" aria-describedby="lu-username-hint">
-          <p id="lu-username-hint" class="mt-1 text-xs text-gray-500">3–64 characters. Letters, numbers, hyphens and underscores only.</p>
+          <p id="lu-username-hint" class="mt-1 text-xs text-gray-500">{{ _("admin_users.local_username_hint") }}</p>
         </div>
         <div>
-          <label for="lu-display-name" class="block text-sm font-medium text-gray-700">Display Name <span class="text-gray-400">(optional)</span></label>
+          <label for="lu-display-name" class="block text-sm font-medium text-gray-700">{{ _("admin_users.col_display_name") }} <span class="text-gray-400">{{ _("admin_users.local_display_name_optional") }}</span></label>
           <input type="text" id="lu-display-name" x-model="localUserModal.form.display_name" autocomplete="off" maxlength="255"
             class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-green-500 focus:ring focus:ring-green-500 focus:ring-opacity-50 text-sm"
             style="min-height:40px;">
         </div>
         <div>
-          <label for="lu-password" class="block text-sm font-medium text-gray-700">Password <span aria-hidden="true" class="text-red-500">*</span></label>
+          <label for="lu-password" class="block text-sm font-medium text-gray-700">{{ _("auth.password_label") }} <span aria-hidden="true" class="text-red-500">*</span></label>
           <input type="password" id="lu-password" x-model="localUserModal.form.password" required autocomplete="new-password"
             minlength="8" maxlength="128"
             class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-green-500 focus:ring focus:ring-green-500 focus:ring-opacity-50 text-sm"
             style="min-height:40px;" aria-required="true" aria-describedby="lu-password-hint">
-          <p id="lu-password-hint" class="mt-1 text-xs text-gray-500">Minimum 8 characters.</p>
+          <p id="lu-password-hint" class="mt-1 text-xs text-gray-500">{{ _("admin_users.local_password_hint") }}</p>
         </div>
         <div class="flex items-center gap-2">
           <input type="checkbox" id="lu-is-admin" x-model="localUserModal.form.is_admin"
             class="h-4 w-4 rounded border-gray-300 text-green-600 focus:ring-green-500">
-          <label for="lu-is-admin" class="text-sm text-gray-700">Grant admin privileges</label>
+          <label for="lu-is-admin" class="text-sm text-gray-700">{{ _("admin_users.local_admin_privileges") }}</label>
         </div>
         <div x-show="localUserModal.error" x-cloak
           class="bg-red-50 border-l-4 border-red-500 text-red-700 p-3 rounded text-sm"
@@ -608,12 +608,12 @@
         <div class="flex justify-end gap-3 pt-2">
           <button type="button" @click="localUserModal.open = false"
             class="px-4 py-2 text-sm font-medium border border-gray-300 rounded-md text-gray-700 bg-white hover:bg-gray-50">
-            Cancel
+            {{ _("common.cancel") }}
           </button>
           <button type="submit" :disabled="localUserModal.saving"
             class="px-4 py-2 text-sm font-medium rounded-md text-white bg-green-600 hover:bg-green-700 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-green-500 disabled:opacity-50">
-            <span x-show="!localUserModal.saving">Create Account</span>
-            <span x-show="localUserModal.saving" x-cloak><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Creating…</span>
+            <span x-show="!localUserModal.saving">{{ _("admin_users.local_create_btn") }}</span>
+            <span x-show="localUserModal.saving" x-cloak><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> {{ _("admin_users.local_creating") }}</span>
           </button>
         </div>
       </form>
@@ -633,20 +633,20 @@
   >
     <div class="bg-white rounded-lg shadow-xl w-full max-w-lg" @click.outside="editLocalUserModal.open = false">
       <div class="px-6 py-4 border-b flex items-center justify-between">
-        <h2 id="edit-local-user-title" class="text-lg font-semibold text-gray-900">Edit Local Account</h2>
-        <button type="button" @click="editLocalUserModal.open = false" aria-label="Close" class="text-gray-400 hover:text-gray-600">
+        <h2 id="edit-local-user-title" class="text-lg font-semibold text-gray-900">{{ _("admin_users.edit_local_title") }}</h2>
+        <button type="button" @click="editLocalUserModal.open = false" aria-label="{{ _('common.close') }}" class="text-gray-400 hover:text-gray-600">
           <i class="fas fa-times" aria-hidden="true"></i>
         </button>
       </div>
       <form @submit.prevent="submitEditLocalUser" class="px-6 py-5 space-y-4">
         <div>
-          <label for="elu-email" class="block text-sm font-medium text-gray-700">Email <span aria-hidden="true" class="text-red-500">*</span></label>
+          <label for="elu-email" class="block text-sm font-medium text-gray-700">{{ _("admin_users.col_email") }} <span aria-hidden="true" class="text-red-500">*</span></label>
           <input type="email" id="elu-email" x-model="editLocalUserModal.form.email" required autocomplete="off"
             class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring focus:ring-blue-500 focus:ring-opacity-50 text-sm"
             style="min-height:40px;" aria-required="true">
         </div>
         <div>
-          <label for="elu-display-name" class="block text-sm font-medium text-gray-700">Display Name <span class="text-gray-400">(optional)</span></label>
+          <label for="elu-display-name" class="block text-sm font-medium text-gray-700">{{ _("admin_users.col_display_name") }} <span class="text-gray-400">{{ _("admin_users.local_display_name_optional") }}</span></label>
           <input type="text" id="elu-display-name" x-model="editLocalUserModal.form.display_name" autocomplete="off" maxlength="255"
             class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-blue-500 focus:ring focus:ring-blue-500 focus:ring-opacity-50 text-sm"
             style="min-height:40px;">
@@ -654,12 +654,12 @@
         <div class="flex items-center gap-2">
           <input type="checkbox" id="elu-is-admin" x-model="editLocalUserModal.form.is_admin"
             class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500">
-          <label for="elu-is-admin" class="text-sm text-gray-700">Admin privileges</label>
+          <label for="elu-is-admin" class="text-sm text-gray-700">{{ _("admin_users.local_admin_privileges_short") }}</label>
         </div>
         <div class="flex items-center gap-2">
           <input type="checkbox" id="elu-is-active" x-model="editLocalUserModal.form.is_active"
             class="h-4 w-4 rounded border-gray-300 text-blue-600 focus:ring-blue-500">
-          <label for="elu-is-active" class="text-sm text-gray-700">Account active</label>
+          <label for="elu-is-active" class="text-sm text-gray-700">{{ _("admin_users.local_account_active") }}</label>
         </div>
         <div x-show="editLocalUserModal.error" x-cloak
           class="bg-red-50 border-l-4 border-red-500 text-red-700 p-3 rounded text-sm"
@@ -668,12 +668,12 @@
         <div class="flex justify-end gap-3 pt-2">
           <button type="button" @click="editLocalUserModal.open = false"
             class="px-4 py-2 text-sm font-medium border border-gray-300 rounded-md text-gray-700 bg-white hover:bg-gray-50">
-            Cancel
+            {{ _("common.cancel") }}
           </button>
           <button type="submit" :disabled="editLocalUserModal.saving"
             class="px-4 py-2 text-sm font-medium rounded-md text-white bg-blue-600 hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-blue-500 disabled:opacity-50">
-            <span x-show="!editLocalUserModal.saving">Save Changes</span>
-            <span x-show="editLocalUserModal.saving" x-cloak><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Saving…</span>
+            <span x-show="!editLocalUserModal.saving">{{ _("admin_users.modal_save_changes") }}</span>
+            <span x-show="editLocalUserModal.saving" x-cloak><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> {{ _("admin_users.local_saving") }}</span>
           </button>
         </div>
       </form>
@@ -693,23 +693,23 @@
   >
     <div class="bg-white rounded-lg shadow-xl w-full max-w-md" @click.outside="setPasswordModal.open = false">
       <div class="px-6 py-4 border-b flex items-center justify-between">
-        <h2 id="set-password-title" class="text-lg font-semibold text-gray-900">Set Temporary Password</h2>
-        <button type="button" @click="setPasswordModal.open = false" aria-label="Close" class="text-gray-400 hover:text-gray-600">
+        <h2 id="set-password-title" class="text-lg font-semibold text-gray-900">{{ _("admin_users.set_password_title") }}</h2>
+        <button type="button" @click="setPasswordModal.open = false" aria-label="{{ _('common.close') }}" class="text-gray-400 hover:text-gray-600">
           <i class="fas fa-times" aria-hidden="true"></i>
         </button>
       </div>
       <form @submit.prevent="submitSetPassword" class="px-6 py-5 space-y-4">
         <p class="text-sm text-gray-600">
-          Set a new password directly for <strong class="font-mono" x-text="setPasswordModal.username"></strong>.
-          The user should change this password after logging in.
+          {{ _("admin_users.set_password_desc_pre") }} <strong class="font-mono" x-text="setPasswordModal.username"></strong>.
+          {{ _("admin_users.set_password_desc") }}
         </p>
         <div>
-          <label for="sp-password" class="block text-sm font-medium text-gray-700">New Password <span aria-hidden="true" class="text-red-500">*</span></label>
+          <label for="sp-password" class="block text-sm font-medium text-gray-700">{{ _("admin_users.new_password_label") }} <span aria-hidden="true" class="text-red-500">*</span></label>
           <input type="password" id="sp-password" x-model="setPasswordModal.password" required autocomplete="new-password"
             minlength="8" maxlength="128"
             class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-yellow-500 focus:ring focus:ring-yellow-500 focus:ring-opacity-50 text-sm"
             style="min-height:40px;" aria-required="true" aria-describedby="sp-password-hint">
-          <p id="sp-password-hint" class="mt-1 text-xs text-gray-500">Minimum 8 characters.</p>
+          <p id="sp-password-hint" class="mt-1 text-xs text-gray-500">{{ _("admin_users.local_password_hint") }}</p>
         </div>
         <div x-show="setPasswordModal.error" x-cloak
           class="bg-red-50 border-l-4 border-red-500 text-red-700 p-3 rounded text-sm"
@@ -718,12 +718,12 @@
         <div class="flex justify-end gap-3 pt-2">
           <button type="button" @click="setPasswordModal.open = false"
             class="px-4 py-2 text-sm font-medium border border-gray-300 rounded-md text-gray-700 bg-white hover:bg-gray-50">
-            Cancel
+            {{ _("common.cancel") }}
           </button>
           <button type="submit" :disabled="setPasswordModal.saving"
             class="px-4 py-2 text-sm font-medium rounded-md text-white bg-yellow-600 hover:bg-yellow-700 focus:outline-none focus:ring-2 focus:ring-offset-1 focus:ring-yellow-500 disabled:opacity-50">
-            <span x-show="!setPasswordModal.saving">Set Password</span>
-            <span x-show="setPasswordModal.saving" x-cloak><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Setting…</span>
+            <span x-show="!setPasswordModal.saving">{{ _("admin_users.set_password_btn") }}</span>
+            <span x-show="setPasswordModal.saving" x-cloak><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> {{ _("admin_users.setting") }}</span>
           </button>
         </div>
       </form>
@@ -743,25 +743,25 @@
   >
     <div class="bg-white rounded-lg shadow-xl w-full max-w-md" @click.outside="deleteLocalUserModal.open = false">
       <div class="px-6 py-4 border-b">
-        <h2 id="delete-local-user-title" class="text-lg font-semibold text-gray-900">Delete Local Account</h2>
+        <h2 id="delete-local-user-title" class="text-lg font-semibold text-gray-900">{{ _("admin_users.delete_local_title") }}</h2>
       </div>
       <div class="px-6 py-5">
         <p class="text-sm text-gray-700">
-          Are you sure you want to delete the account for
+          {{ _("admin_users.delete_local_confirm") }}
           <strong class="font-mono" x-text="deleteLocalUserModal.username"></strong>
           (<span class="font-mono" x-text="deleteLocalUserModal.email"></span>)?
         </p>
-        <p class="text-sm text-gray-500 mt-2">This cannot be undone. Documents owned by this user are <strong>not</strong> deleted.</p>
+        <p class="text-sm text-gray-500 mt-2">{{ _("admin_users.delete_local_warning") }}</p>
       </div>
       <div class="px-6 py-4 border-t flex justify-end gap-3">
         <button type="button" @click="deleteLocalUserModal.open = false"
           class="px-4 py-2 text-sm font-medium border border-gray-300 rounded-md text-gray-700 bg-white hover:bg-gray-50">
-          Cancel
+          {{ _("common.cancel") }}
         </button>
         <button type="button" @click="executeDeleteLocalUser()" :disabled="deleteLocalUserModal.deleting"
           class="px-4 py-2 text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 disabled:opacity-50">
-          <span x-show="!deleteLocalUserModal.deleting">Delete Account</span>
-          <span x-show="deleteLocalUserModal.deleting" x-cloak><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Deleting…</span>
+          <span x-show="!deleteLocalUserModal.deleting">{{ _("admin_users.delete_account_btn") }}</span>
+          <span x-show="deleteLocalUserModal.deleting" x-cloak><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> {{ _("admin_users.deleting") }}</span>
         </button>
       </div>
     </div>
@@ -780,15 +780,15 @@
   >
     <div class="bg-white rounded-lg shadow-xl w-full max-w-md" @click.outside="deleteModal.open = false">
       <div class="px-6 py-4 border-b">
-        <h2 id="delete-modal-title" class="text-lg font-semibold text-gray-900">Delete User Profile</h2>
+        <h2 id="delete-modal-title" class="text-lg font-semibold text-gray-900">{{ _("admin_users.delete_profile_title") }}</h2>
       </div>
       <div class="px-6 py-5">
         <p class="text-sm text-gray-700">
-          Are you sure you want to delete the profile for
+          {{ _("admin_users.delete_profile_confirm") }}
           <strong class="font-mono" x-text="deleteModal.user_id"></strong>?
         </p>
         <p class="text-sm text-gray-500 mt-2">
-          This only removes the admin-managed profile record. Documents owned by this user are <strong>not</strong> deleted.
+          {{ _("admin_users.delete_profile_warning") }}
         </p>
       </div>
       <div class="px-6 py-4 border-t flex justify-end gap-3">
@@ -797,7 +797,7 @@
           @click="deleteModal.open = false"
           class="px-4 py-2 text-sm font-medium border border-gray-300 rounded-md text-gray-700 bg-white hover:bg-gray-50"
         >
-          Cancel
+          {{ _("common.cancel") }}
         </button>
         <button
           type="button"
@@ -805,8 +805,8 @@
           :disabled="deleteModal.deleting"
           class="px-4 py-2 text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700 disabled:opacity-50"
         >
-          <span x-show="!deleteModal.deleting">Delete Profile</span>
-          <span x-show="deleteModal.deleting"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> Deleting…</span>
+          <span x-show="!deleteModal.deleting">{{ _("admin_users.delete_profile_btn") }}</span>
+          <span x-show="deleteModal.deleting"><i class="fas fa-spinner fa-spin mr-1" aria-hidden="true"></i> {{ _("admin_users.deleting") }}</span>
         </button>
       </div>
     </div>
@@ -814,8 +814,43 @@
 
 </div>
 
+<script>
+  window.__i18nAdminUsers = {
+    noUsers: {{ _("admin_users.total_no_users") | tojson }},
+    oneUser: {{ _("admin_users.total_one_user") | tojson }},
+    countUsers: {{ _("admin_users.total_count_users") | tojson }},
+    modalAddTitle: {{ _("admin_users.modal_add_title") | tojson }},
+    modalEditTitle: {{ _("admin_users.modal_edit_title") | tojson }},
+    failedLoadUsers: {{ _("admin_users.js_failed_load_users") | tojson }},
+    networkError: {{ _("admin_users.js_network_error") | tojson }},
+    saveFailed: {{ _("admin_users.js_save_failed") | tojson }},
+    saved: {{ _("admin_users.js_saved") | tojson }},
+    profileSaved: {{ _("admin_users.js_profile_saved") | tojson }},
+    deleteFailed: {{ _("admin_users.js_delete_failed") | tojson }},
+    deleted: {{ _("admin_users.js_deleted") | tojson }},
+    profileDeleted: {{ _("admin_users.js_profile_deleted") | tojson }},
+    failedLoadLocal: {{ _("admin_users.js_failed_load_local") | tojson }},
+    accountCreated: {{ _("admin_users.js_account_created") | tojson }},
+    accountCreatedMsg: {{ _("admin_users.js_account_created_msg") | tojson }},
+    failedCreate: {{ _("admin_users.js_failed_create") | tojson }},
+    accountDeletedMsg: {{ _("admin_users.js_account_deleted_msg") | tojson }},
+    updated: {{ _("admin_users.js_updated") | tojson }},
+    accountUpdated: {{ _("admin_users.js_account_updated") | tojson }},
+    failedUpdate: {{ _("admin_users.js_failed_update") | tojson }},
+    passwordSet: {{ _("admin_users.js_password_set") | tojson }},
+    passwordSetMsg: {{ _("admin_users.js_password_set_msg") | tojson }},
+    failedSetPassword: {{ _("admin_users.js_failed_set_password") | tojson }},
+    emailSent: {{ _("admin_users.js_email_sent") | tojson }},
+    emailSentMsg: {{ _("admin_users.js_email_sent_msg") | tojson }},
+    emailNotSent: {{ _("admin_users.js_email_not_sent") | tojson }},
+    smtpNotConfigured: {{ _("admin_users.js_smtp_not_configured") | tojson }},
+    failed: {{ _("admin_users.js_failed") | tojson }},
+  };
+</script>
+
 <script>
 function adminUsersApp() {
+  const i18n = window.__i18nAdminUsers;
   return {
     // State
     users: [],
@@ -887,8 +922,9 @@ function adminUsersApp() {
 
     get totalLabel() {
       if (this.loading) return '';
-      if (this.total === 0) return 'No users';
-      return `${this.total} user${this.total !== 1 ? 's' : ''}`;
+      if (this.total === 0) return i18n.noUsers;
+      if (this.total === 1) return i18n.oneUser;
+      return i18n.countUsers.replace('{count}', this.total);
     },
 
     async init() {
@@ -908,7 +944,7 @@ function adminUsersApp() {
         const resp = await fetch(`/api/admin/users/?${params}`);
         if (!resp.ok) {
           const err = await resp.json().catch(() => ({}));
-          this.showAlert('error', 'Failed to load users', err.detail || resp.statusText);
+          this.showAlert('error', i18n.failedLoadUsers, err.detail || resp.statusText);
           return;
         }
         const data = await resp.json();
@@ -916,7 +952,7 @@ function adminUsersApp() {
         this.total = data.total;
         this.pages = data.pages;
       } catch (e) {
-        this.showAlert('error', 'Network error', e.message);
+        this.showAlert('error', i18n.networkError, e.message);
       } finally {
         this.loading = false;
       }
@@ -924,14 +960,14 @@ function adminUsersApp() {
 
     openCreateModal() {
       this.isCreate = true;
-      this.modalTitle = 'Add User Profile';
+      this.modalTitle = i18n.modalAddTitle;
       this.form = { user_id: '', display_name: '', daily_upload_limit: null, notes: '', is_blocked: false, subscription_tier: 'free', subscription_billing_cycle: 'monthly', subscription_period_start: null, is_complimentary: false };
       this.modalOpen = true;
     },
 
     openEditModal(user) {
       this.isCreate = false;
-      this.modalTitle = 'Edit User Profile';
+      this.modalTitle = i18n.modalEditTitle;
       this.form = {
         user_id: user.user_id,
         display_name: user.display_name || '',
@@ -970,14 +1006,14 @@ function adminUsersApp() {
         });
         if (!resp.ok) {
           const err = await resp.json().catch(() => ({}));
-          this.showAlert('error', 'Save failed', err.detail || resp.statusText);
+          this.showAlert('error', i18n.saveFailed, err.detail || resp.statusText);
           return;
         }
         this.modalOpen = false;
-        this.showAlert('success', 'Saved', `Profile for "${this.form.user_id}" has been saved.`);
+        this.showAlert('success', i18n.saved, i18n.profileSaved.replace('{id}', this.form.user_id));
         await this.fetchUsers(this.currentPage);
       } catch (e) {
-        this.showAlert('error', 'Network error', e.message);
+        this.showAlert('error', i18n.networkError, e.message);
       } finally {
         this.saving = false;
       }
@@ -1001,15 +1037,15 @@ function adminUsersApp() {
         });
         if (resp.status === 204) {
           this.deleteModal.open = false;
-          this.showAlert('success', 'Deleted', `Profile for "${this.deleteModal.user_id}" has been removed.`);
+          this.showAlert('success', i18n.deleted, i18n.profileDeleted.replace('{id}', this.deleteModal.user_id));
           await this.fetchUsers(this.currentPage);
         } else {
           const err = await resp.json().catch(() => ({}));
-          this.showAlert('error', 'Delete failed', err.detail || resp.statusText);
+          this.showAlert('error', i18n.deleteFailed, err.detail || resp.statusText);
           this.deleteModal.open = false;
         }
       } catch (e) {
-        this.showAlert('error', 'Network error', e.message);
+        this.showAlert('error', i18n.networkError, e.message);
         this.deleteModal.open = false;
       } finally {
         this.deleteModal.deleting = false;
@@ -1044,12 +1080,12 @@ function adminUsersApp() {
           headers: { 'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]')?.content || '' },
         });
         if (!resp.ok) {
-          this.showAlert('error', 'Failed to load local users', resp.statusText);
+          this.showAlert('error', i18n.failedLoadLocal, resp.statusText);
           return;
         }
         this.localUsers = await resp.json();
       } catch (e) {
-        this.showAlert('error', 'Network error', e.message);
+        this.showAlert('error', i18n.networkError, e.message);
       } finally {
         this.localUsersLoading = false;
       }
@@ -1076,14 +1112,14 @@ function adminUsersApp() {
         });
         if (resp.ok) {
           this.localUserModal.open = false;
-          this.showAlert('success', 'Account created', `Local account for "${this.localUserModal.form.username}" was created successfully.`);
+          this.showAlert('success', i18n.accountCreated, i18n.accountCreatedMsg.replace('{username}', this.localUserModal.form.username));
           await this.fetchLocalUsers();
         } else {
           const err = await resp.json().catch(() => ({}));
-          this.localUserModal.error = err.detail || 'Failed to create account.';
+          this.localUserModal.error = err.detail || i18n.failedCreate;
         }
       } catch (e) {
-        this.localUserModal.error = 'Network error: ' + e.message;
+        this.localUserModal.error = i18n.networkError + ': ' + e.message;
       } finally {
         this.localUserModal.saving = false;
       }
@@ -1129,14 +1165,14 @@ function adminUsersApp() {
         });
         if (resp.ok) {
           this.editLocalUserModal.open = false;
-          this.showAlert('success', 'Updated', `Account has been updated.`);
+          this.showAlert('success', i18n.updated, i18n.accountUpdated);
           await this.fetchLocalUsers();
         } else {
           const err = await resp.json().catch(() => ({}));
-          this.editLocalUserModal.error = err.detail || 'Failed to update account.';
+          this.editLocalUserModal.error = err.detail || i18n.failedUpdate;
         }
       } catch (e) {
-        this.editLocalUserModal.error = 'Network error: ' + e.message;
+        this.editLocalUserModal.error = i18n.networkError + ': ' + e.message;
       } finally {
         this.editLocalUserModal.saving = false;
       }
@@ -1165,13 +1201,13 @@ function adminUsersApp() {
         });
         if (resp.ok) {
           this.setPasswordModal.open = false;
-          this.showAlert('success', 'Password set', `Password for "${this.setPasswordModal.username}" has been updated.`);
+          this.showAlert('success', i18n.passwordSet, i18n.passwordSetMsg.replace('{username}', this.setPasswordModal.username));
         } else {
           const err = await resp.json().catch(() => ({}));
-          this.setPasswordModal.error = err.detail || 'Failed to set password.';
+          this.setPasswordModal.error = err.detail || i18n.failedSetPassword;
         }
       } catch (e) {
-        this.setPasswordModal.error = 'Network error: ' + e.message;
+        this.setPasswordModal.error = i18n.networkError + ': ' + e.message;
       } finally {
         this.setPasswordModal.saving = false;
       }
@@ -1187,14 +1223,14 @@ function adminUsersApp() {
         });
         const data = await resp.json().catch(() => ({}));
         if (resp.ok && data.sent) {
-          this.showAlert('success', 'Email sent', `Password reset email sent to "${lu.email}".`);
+          this.showAlert('success', i18n.emailSent, i18n.emailSentMsg.replace('{email}', lu.email));
         } else if (resp.ok && !data.sent) {
-          this.showAlert('error', 'Email not sent', data.reason || 'SMTP is not configured.');
+          this.showAlert('error', i18n.emailNotSent, data.reason || i18n.smtpNotConfigured);
         } else {
-          this.showAlert('error', 'Failed', data.detail || resp.statusText);
+          this.showAlert('error', i18n.failed, data.detail || resp.statusText);
         }
       } catch (e) {
-        this.showAlert('error', 'Network error', e.message);
+        this.showAlert('error', i18n.networkError, e.message);
       }
     },
 
@@ -1207,15 +1243,15 @@ function adminUsersApp() {
         });
         if (resp.status === 204) {
           this.deleteLocalUserModal.open = false;
-          this.showAlert('success', 'Deleted', `Account for "${this.deleteLocalUserModal.username}" has been removed.`);
+          this.showAlert('success', i18n.deleted, i18n.accountDeletedMsg.replace('{username}', this.deleteLocalUserModal.username));
           await this.fetchLocalUsers();
         } else {
           const err = await resp.json().catch(() => ({}));
-          this.showAlert('error', 'Delete failed', err.detail || resp.statusText);
+          this.showAlert('error', i18n.deleteFailed, err.detail || resp.statusText);
           this.deleteLocalUserModal.open = false;
         }
       } catch (e) {
-        this.showAlert('error', 'Network error', e.message);
+        this.showAlert('error', i18n.networkError, e.message);
         this.deleteLocalUserModal.open = false;
       } finally {
         this.deleteLocalUserModal.deleting = false;

frontend/templates/attribution.html

@@ -1,40 +1,40 @@
 {% extends "base.html" %}
 
-{% block title %}DocuElevate - Third-Party Attributions{% endblock %}
+{% block title %}{{ _("attribution.page_title") }}{% endblock %}
 
 {% block content %}
 <div class="container mx-auto px-4 py-8">
-    <h1 class="text-2xl font-bold mb-4">Third-Party Software Attributions</h1>
+    <h1 class="text-2xl font-bold mb-4">{{ _("attribution.heading") }}</h1>
 
     <div class="bg-white shadow-md rounded-lg p-6 mb-6">
         <p class="mb-4">
-            DocuElevate uses several open source libraries and tools. We are grateful to the
-            developers of these projects for their contributions to open source software.
+            {{ _("attribution.intro") }}
         </p>
 
         <div class="bg-yellow-50 border-l-4 border-yellow-400 p-4 mb-6">
             <div class="flex">
                 <div class="flex-shrink-0">
-                    <svg class="h-5 w-5 text-yellow-400" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor">
+                    <svg class="h-5 w-5 text-yellow-400" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
                         <path fill-rule="evenodd" d="M8.257 3.099c.765-1.36 2.722-1.36 3.486 0l5.58 9.92c.75 1.334-.213 2.98-1.742 2.98H4.42c-1.53 0-2.493-1.646-1.743-2.98l5.58-9.92zM11 13a1 1 0 11-2 0 1 1 0 012 0zm-1-8a1 1 0 00-1 1v3a1 1 0 002 0V6a1 1 0 00-1-1z" clip-rule="evenodd" />
                     </svg>
                 </div>
                 <div class="ml-3">
                     <p class="text-sm text-yellow-700">
-                        <strong>Special Attribution:</strong> This software includes Paramiko, which is licensed under LGPL. The source code for Paramiko is available at
+                        <strong>{{ _("attribution.special_title") }}</strong>
+                        {{ _("attribution.special_source_pre") }}
                         <a href="https://github.com/paramiko/paramiko" class="font-medium underline text-yellow-700 hover:text-yellow-600">
                             https://github.com/paramiko/paramiko
-                        </a>.
-                        A copy of the LGPL license can be found
+                        </a>{{ _("attribution.special_source_post") }}
+                        {{ _("attribution.special_lgpl_pre") }}
                         <a href="/static/licenses/lgpl.txt" class="font-medium underline text-yellow-700 hover:text-yellow-600">
-                            here
-                        </a>.
+                            {{ _("attribution.special_lgpl_link") }}
+                        </a>{{ _("attribution.special_lgpl_post") }}
                     </p>
                 </div>
             </div>
         </div>
 
-        <h2 class="text-xl font-semibold mb-2">Python Dependencies</h2>
+        <h2 class="text-xl font-semibold mb-2">{{ _("attribution.section_python") }}</h2>
         <ul class="list-disc pl-5 mb-4">
             <li class="mb-2">
                 <span class="font-semibold">FastAPI</span> (MIT License)<br>
@@ -130,7 +130,7 @@
                 <span class="font-semibold">Paramiko</span> (LGPL-2.1 License)<br>
                 Copyright (c) 2003-2009 Robey Pointer<br>
                 <a href="https://github.com/paramiko/paramiko" class="text-blue-600 hover:underline">https://github.com/paramiko/paramiko</a><br>
-                <span class="text-sm text-gray-600">Note: This library is licensed under the GNU Lesser General Public License v2.1 (LGPL-2.1)</span>
+                <span class="text-sm text-gray-600">{{ _("attribution.paramiko_lgpl_note") }}</span>
             </li>
             <li class="mb-2">
                 <span class="font-semibold">Apprise</span> (MIT License)<br>
@@ -139,7 +139,7 @@
             </li>
         </ul>
 
-        <h2 class="text-xl font-semibold mb-2">Docker Images</h2>
+        <h2 class="text-xl font-semibold mb-2">{{ _("attribution.section_docker") }}</h2>
         <ul class="list-disc pl-5 mb-4">
             <li class="mb-2">
                 <span class="font-semibold">Redis</span> (BSD License)<br>
@@ -153,7 +153,7 @@
             </li>
         </ul>
 
-        <h2 class="text-xl font-semibold mb-2">Frontend Dependencies</h2>
+        <h2 class="text-xl font-semibold mb-2">{{ _("attribution.section_frontend") }}</h2>
         <ul class="list-disc pl-5 mb-4">
             <li class="mb-2">
                 <span class="font-semibold">Tailwind CSS</span> (MIT License)<br>

frontend/templates/base.html

@@ -27,6 +27,9 @@
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css"
           integrity="sha512-DTOQO9RWCH3ppGqcWaEA1BIZOC6xxalwEsw9c2QQeAIftl+Vegovlnee1c9QX4TctnWMn13TZye+giMm8e2LwA=="
           crossorigin="anonymous" referrerpolicy="no-referrer" />
+    <!-- flag-icons: SVG/CSS flag sprites that render correctly on all platforms including Windows -->
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/flag-icons@7.3.2/css/flag-icons.min.css"
+          crossorigin="anonymous" referrerpolicy="no-referrer" />
     {% endblock %}
     {% block head_extra %}{% endblock %}
     <!-- CSRF token for AJAX/fetch requests -->
@@ -174,6 +177,11 @@
                   <a href="/admin/backup" role="menuitem" class="flex items-center px-4 py-2 text-sm text-gray-700 hover:bg-gray-100">
                     <i class="fas fa-database w-4 mr-2 text-green-600" aria-hidden="true"></i> {{ _("nav.backup_restore") }}
                   </a>
+                  {% if enable_factory_reset %}
+                  <a href="/admin/system-reset" role="menuitem" class="flex items-center px-4 py-2 text-sm text-red-600 hover:bg-red-50">
+                    <i class="fas fa-skull-crossbones w-4 mr-2 text-red-500" aria-hidden="true"></i> {{ _("nav.system_reset") }}
+                  </a>
+                  {% endif %}
                   <a href="/admin/audit-logs" role="menuitem" class="flex items-center px-4 py-2 text-sm text-gray-700 hover:bg-gray-100">
                     <i class="fas fa-shield-halved w-4 mr-2 text-indigo-500" aria-hidden="true"></i> Audit Logs
                   </a>
@@ -216,11 +224,31 @@
                     aria-live="polite"></span>
             </a>
 
+            <!-- Language selector data (kept outside the HTML attribute to avoid quote conflicts with tojson) -->
+            <script>
+              window.__langSuggested = {{ suggested_languages | tojson }};
+              window.__langAll = {{ supported_languages | tojson }};
+            </script>
+
             <!-- Language selector dropdown -->
-            <div x-data="{ langOpen: false }" class="relative">
+            <div x-data="{
+              langOpen: false,
+              search: '',
+              suggested: window.__langSuggested,
+              all: window.__langAll,
+              get filtered() {
+                if (!this.search.trim()) return this.suggested;
+                const q = this.search.trim().toLowerCase();
+                return this.all.filter(l =>
+                  l.native.toLowerCase().includes(q) ||
+                  l.name.toLowerCase().includes(q) ||
+                  l.code.toLowerCase().startsWith(q)
+                );
+              }
+            }" class="relative" @keydown.escape="langOpen = false; search = ''">
               <button
-                @click="langOpen = !langOpen"
-                @click.outside="langOpen = false"
+                @click="langOpen = !langOpen; if (langOpen) $nextTick(() => { if ($refs.langSearch) $refs.langSearch.focus(); })"
+                @click.outside="langOpen = false; search = ''"
                 type="button"
                 class="p-1.5 rounded-md text-gray-500 hover:text-gray-700 hover:bg-gray-100 focus:outline-none focus:ring-2 focus:ring-inset focus:ring-blue-500"
                 aria-label="{{ _('language.selector') }}"
@@ -228,7 +256,10 @@
                 :aria-expanded="langOpen"
                 aria-haspopup="true"
               >
-                <i class="fas fa-globe"></i>
+                <span class="text-base leading-none" aria-hidden="true">
+                  {% set cur_lang = suggested_languages | selectattr("code", "equalto", current_locale) | list %}
+                  {% if cur_lang %}<span class="fi fi-{{ cur_lang[0].flag }}"></span>{% else %}<i class="fas fa-globe"></i>{% endif %}
+                </span>
               </button>
               <div
                 x-show="langOpen"
@@ -238,25 +269,49 @@
                 x-transition:leave="transition ease-in duration-75 transform"
                 x-transition:leave-start="opacity-100 scale-100"
                 x-transition:leave-end="opacity-0 scale-95"
-                class="absolute right-0 mt-2 w-48 bg-white rounded-md shadow-lg ring-1 ring-black ring-opacity-5 z-50"
+                class="absolute right-0 mt-2 w-56 bg-white dark:bg-gray-800 rounded-md shadow-lg ring-1 ring-black ring-opacity-5 z-50"
                 role="menu"
                 aria-label="{{ _('language.selector') }}"
               >
-                <div class="py-1">
-                  {% for lang in supported_languages %}
-                  <button
-                    type="button"
-                    role="menuitem"
-                    class="flex items-center w-full px-4 py-2 text-sm text-left hover:bg-gray-100 {% if current_locale == lang.code %}bg-blue-50 text-blue-700 font-medium{% else %}text-gray-700{% endif %}"
-                    onclick="setLanguage('{{ lang.code }}')"
-                  >
-                    <span class="mr-2">{{ lang.flag }}</span>
-                    <span>{{ lang.native }}</span>
-                    {% if current_locale == lang.code %}
-                    <i class="fas fa-check ml-auto text-blue-500" aria-hidden="true"></i>
-                    {% endif %}
-                  </button>
-                  {% endfor %}
+                <!-- Search input -->
+                <div class="px-3 pt-2 pb-1">
+                  <div class="relative">
+                    <i class="fas fa-magnifying-glass absolute left-2 top-1/2 -translate-y-1/2 text-gray-400 text-xs pointer-events-none" aria-hidden="true"></i>
+                    <input
+                      x-ref="langSearch"
+                      x-model="search"
+                      type="search"
+                      placeholder="{{ _('language.search_placeholder') }}"
+                      class="w-full pl-6 pr-2 py-1 text-xs border border-gray-300 dark:border-gray-600 rounded focus:outline-none focus:ring-1 focus:ring-blue-400 dark:bg-gray-700 dark:text-white"
+                      aria-label="{{ _('language.search_placeholder') }}"
+                      autocomplete="off"
+                    />
+                  </div>
+                </div>
+                <!-- Language list -->
+                <div class="py-1 max-h-56 overflow-y-auto" role="none">
+                  <template x-for="lang in filtered" :key="lang.code">
+                    <button
+                      type="button"
+                      role="menuitem"
+                      :class="lang.code === '{{ current_locale }}' ? 'bg-blue-50 dark:bg-blue-900/30 text-blue-700 dark:text-blue-300 font-medium' : 'text-gray-700 dark:text-gray-200'"
+                      class="flex items-center w-full px-4 py-2 text-sm text-left hover:bg-gray-100 dark:hover:bg-gray-700"
+                      :onclick="`setLanguage('${lang.code}')`"
+                    >
+                      <span class="fi mr-2" :class="`fi-${lang.flag}`" aria-hidden="true"></span>
+                      <span x-text="lang.native"></span>
+                      <i x-show="lang.code === '{{ current_locale }}'" class="fas fa-check ml-auto text-blue-500" aria-hidden="true"></i>
+                    </button>
+                  </template>
+                  <p
+                    x-show="filtered.length === 0"
+                    class="px-4 py-2 text-sm text-gray-400 dark:text-gray-500"
+                  >{{ _('language.no_results') }}</p>
+                </div>
+                <!-- Footer hint -->
+                <div x-show="!search.trim()" class="px-3 py-1.5 text-xs text-gray-400 dark:text-gray-500 border-t border-gray-100 dark:border-gray-700 flex items-center justify-between">
+                  <span x-text="`${suggested.length} / {{ supported_languages | length }}`"></span>
+                  <button type="button" @click="$refs.langSearch.focus(); $refs.langSearch.select()" class="text-blue-500 hover:underline">{{ _('common.search') }}…</button>
                 </div>
               </div>
             </div>
@@ -395,6 +450,11 @@
                   <a href="/admin/backup" class="block px-3 py-3 rounded-md text-base font-medium text-gray-700 hover:text-gray-900 hover:bg-gray-50">
                     <i class="fas fa-database mr-2 text-green-500" aria-hidden="true"></i> {{ _("nav.backup_restore") }}
                   </a>
+                  {% if enable_factory_reset %}
+                  <a href="/admin/system-reset" class="block px-3 py-3 rounded-md text-base font-medium text-red-600 hover:text-red-800 hover:bg-red-50">
+                    <i class="fas fa-skull-crossbones mr-2 text-red-500" aria-hidden="true"></i> {{ _("nav.system_reset") }}
+                  </a>
+                  {% endif %}
                   <a href="/status" class="block px-3 py-3 rounded-md text-base font-medium text-gray-700 hover:text-gray-900 hover:bg-gray-50"
                      {% if request and request.url.path == '/status' %}aria-current="page"{% endif %}>
                     <i class="fas fa-circle-dot mr-2 text-gray-400" aria-hidden="true"></i> {{ _("nav.status") }}
@@ -501,6 +561,24 @@
       })();
     </script>
 
+    <!-- i18n strings for common.js (user menu) -->
+    <script>
+      window.__i18n = {
+        accountMenu: {{ _("nav.account_menu") | tojson }},
+        accountMenuFor: {{ _("nav.account_menu_for") | tojson }},
+        avatar: {{ _("common.avatar") | tojson }},
+        profileSettings: {{ _("nav.profile_settings") | tojson }},
+        mySubscription: {{ _("nav.my_subscription") | tojson }},
+        apiTokens: {{ _("nav.api_tokens") | tojson }},
+        devices: {{ _("nav.devices") | tojson }},
+        sharedLinks: {{ _("nav.shared_links") | tojson }},
+        signOut: {{ _("nav.sign_out") | tojson }},
+        logIn: {{ _("nav.login") | tojson }},
+        signUp: {{ _("nav.signup") | tojson }},
+        getStarted: {{ _("nav.get_started") | tojson }},
+      };
+    </script>
+
     <!-- Common JS (shared) -->
     <script src="/static/js/common.js"></script>
 

frontend/templates/cookies.html

@@ -1,58 +1,58 @@
 {% extends "base.html" %}
-{% block title %}Cookie Policy - DocuElevate{% endblock %}
+{% block title %}{{ _("cookie_policy.page_title") }}{% endblock %}
 
 {% block content %}
 <div class="container mx-auto px-4 py-8 max-w-4xl">
-  <h1 class="text-4xl font-bold mb-6">Cookie Policy</h1>
-  <p class="text-sm text-gray-500 mb-8">Last Updated: {{ build_date|default(current_date|default('May 14, 2024')) }}</p>
+  <h1 class="text-4xl font-bold mb-6">{{ _("cookie_policy.heading") }}</h1>
+  <p class="text-sm text-gray-500 mb-8">{{ _("cookie_policy.last_updated") }} {{ build_date|default(current_date|default('May 14, 2024')) }}</p>
 
   <div class="bg-white shadow rounded-lg p-6 mb-6">
-    <h2 class="text-2xl font-semibold mb-4">What Are Cookies</h2>
+    <h2 class="text-2xl font-semibold mb-4">{{ _("cookie_policy.s1_heading") }}</h2>
     <p class="text-gray-700 mb-3">
-      Cookies are small text files that are stored on your computer or mobile device when you visit a website. They are widely used to make websites work more efficiently and provide information to the website owners.
+      {{ _("cookie_policy.s1_p1") }}
     </p>
   </div>
 
   <div class="bg-white shadow rounded-lg p-6 mb-6">
-    <h2 class="text-2xl font-semibold mb-4">How We Use Cookies</h2>
+    <h2 class="text-2xl font-semibold mb-4">{{ _("cookie_policy.s2_heading") }}</h2>
     <p class="text-gray-700 mb-3">
-      DocuElevate uses <strong>only strictly necessary session cookies</strong> for the following purpose:
+      {{ _("cookie_policy.s2_p1_pre") }} <strong>{{ _("cookie_policy.s2_p1_strong") }}</strong> {{ _("cookie_policy.s2_p1_post") }}
     </p>
     <ul class="list-disc list-inside text-gray-700 ml-4 mb-3">
-      <li><strong>Authentication &amp; Session Management:</strong> To identify you when you sign in and maintain your session while you use the application.</li>
+      <li><strong>{{ _("cookie_policy.s2_li1_label") }}</strong> {{ _("cookie_policy.s2_li1_body") }}</li>
     </ul>
     <p class="text-gray-700 mb-3">
-      These cookies are mandatory for the proper functioning of our service. Without these cookies, you would be required to log in repeatedly during your browsing session.
+      {{ _("cookie_policy.s2_p2") }}
     </p>
     <p class="text-gray-700">
-      Because these cookies are strictly necessary for the service to function, they are exempt from prior-consent requirements under the EU ePrivacy Directive (Art. 5(3)) and equivalent national implementations. We do not set any optional, analytics, advertising, or tracking cookies.
+      {{ _("cookie_policy.s2_p3") }}
     </p>
   </div>
 
   <div class="bg-white shadow rounded-lg p-6 mb-6">
-    <h2 class="text-2xl font-semibold mb-4">Cookie Details</h2>
+    <h2 class="text-2xl font-semibold mb-4">{{ _("cookie_policy.s3_heading") }}</h2>
     <div class="overflow-x-auto">
-      <table class="min-w-full text-sm text-gray-700 border border-gray-200 rounded">
+      <table class="min-w-full text-sm text-gray-700 border border-gray-200 rounded" aria-label="{{ _('cookie_policy.s3_heading') }}">
         <thead class="bg-gray-50">
           <tr>
-            <th class="px-4 py-2 text-left font-semibold border-b">Name</th>
-            <th class="px-4 py-2 text-left font-semibold border-b">Type</th>
-            <th class="px-4 py-2 text-left font-semibold border-b">Purpose</th>
-            <th class="px-4 py-2 text-left font-semibold border-b">Duration</th>
+            <th class="px-4 py-2 text-left font-semibold border-b" scope="col">{{ _("cookie_policy.s3_col_name") }}</th>
+            <th class="px-4 py-2 text-left font-semibold border-b" scope="col">{{ _("cookie_policy.s3_col_type") }}</th>
+            <th class="px-4 py-2 text-left font-semibold border-b" scope="col">{{ _("cookie_policy.s3_col_purpose") }}</th>
+            <th class="px-4 py-2 text-left font-semibold border-b" scope="col">{{ _("cookie_policy.s3_col_duration") }}</th>
           </tr>
         </thead>
         <tbody>
           <tr class="border-b">
             <td class="px-4 py-2 font-mono">session</td>
-            <td class="px-4 py-2">Strictly Necessary</td>
-            <td class="px-4 py-2">Maintains your authenticated session; required for login to function.</td>
-            <td class="px-4 py-2">Session (deleted on browser close or logout)</td>
+            <td class="px-4 py-2">{{ _("cookie_policy.s3_row1_type") }}</td>
+            <td class="px-4 py-2">{{ _("cookie_policy.s3_row1_purpose") }}</td>
+            <td class="px-4 py-2">{{ _("cookie_policy.s3_row1_duration") }}</td>
           </tr>
           <tr>
             <td class="px-4 py-2 font-mono">cookieNoticeDismissed</td>
-            <td class="px-4 py-2">Strictly Necessary</td>
-            <td class="px-4 py-2">Stores your acknowledgement of the cookie notice so it is not shown repeatedly (stored in localStorage, not a cookie).</td>
-            <td class="px-4 py-2">Persistent (browser localStorage)</td>
+            <td class="px-4 py-2">{{ _("cookie_policy.s3_row2_type") }}</td>
+            <td class="px-4 py-2">{{ _("cookie_policy.s3_row2_purpose") }}</td>
+            <td class="px-4 py-2">{{ _("cookie_policy.s3_row2_duration") }}</td>
           </tr>
         </tbody>
       </table>
@@ -60,25 +60,26 @@
   </div>
 
   <div class="bg-white shadow rounded-lg p-6 mb-6">
-    <h2 class="text-2xl font-semibold mb-4">No Third-Party Cookies</h2>
+    <h2 class="text-2xl font-semibold mb-4">{{ _("cookie_policy.s4_heading") }}</h2>
     <p class="text-gray-700 mb-3">
-      DocuElevate does not use any third-party cookies, tracking cookies, advertising cookies, or analytics cookies. We respect your privacy and only implement the minimum cookies required for our service to function.
+      {{ _("cookie_policy.s4_p1") }}
     </p>
     <p class="text-gray-700">
-      For more information about how we handle your data, please see our <a href="/privacy" class="text-blue-600 hover:underline">Privacy Notice</a>.
+      {{ _("cookie_policy.s4_p2_pre") }} <a href="/privacy" class="text-blue-600 hover:underline">{{ _("cookie_policy.s4_privacy_link") }}</a>.
     </p>
   </div>
 
   <div class="bg-white shadow rounded-lg p-6 mb-6">
-    <h2 class="text-2xl font-semibold mb-4">Managing Cookies</h2>
+    <h2 class="text-2xl font-semibold mb-4">{{ _("cookie_policy.s5_heading") }}</h2>
     <p class="text-gray-700 mb-3">
-      Most web browsers allow you to control cookies through their settings. However, blocking or deleting our session cookies will prevent DocuElevate from functioning, as user authentication relies on these cookies.
+      {{ _("cookie_policy.s5_p1") }}
     </p>
     <p class="text-gray-700 mb-3">
-      You may also clear the cookie notice acknowledgement stored in your browser's localStorage at any time via your browser's developer tools (Application &rarr; Local Storage).
+      {{ _("cookie_policy.s5_p2") }}
     </p>
     <p class="text-gray-700">
-      This Cookie Policy is part of and incorporated into our <a href="/terms" class="text-blue-600 hover:underline">Terms of Service</a> and <a href="/privacy" class="text-blue-600 hover:underline">Privacy Notice</a>.
+      {{ _("cookie_policy.s5_p3_pre") }} <a href="/terms" class="text-blue-600 hover:underline">{{ _("cookie_policy.s5_terms_link") }}</a>
+      {{ _("cookie_policy.s5_p3_and") }} <a href="/privacy" class="text-blue-600 hover:underline">{{ _("cookie_policy.s5_privacy_link") }}</a>.
     </p>
   </div>
 </div>

frontend/templates/devices.html

@@ -0,0 +1,351 @@
+{% extends "base.html" %}
+
+{% block title %}{{ _("devices.page_title") }}{% endblock %}
+
+{% block content %}
+<div x-data="devicesPage()" x-init="init()" class="container mx-auto px-4 py-8 max-w-4xl">
+
+  <!-- ── Header ─────────────────────────────────────────────────────────── -->
+  <header class="mb-8">
+    <h1 class="text-2xl font-bold text-gray-900 dark:text-white flex items-center gap-2">
+      <i class="fas fa-mobile-alt text-blue-500" aria-hidden="true"></i>
+      {{ _("devices.heading") }}
+    </h1>
+    <p class="mt-2 text-gray-600 dark:text-gray-400 text-sm leading-relaxed max-w-2xl">
+      {{ _("devices.intro") }}
+    </p>
+  </header>
+
+  <!-- ── Mobile App Tokens ──────────────────────────────────────────────── -->
+  <section class="bg-white dark:bg-gray-800 shadow rounded-lg overflow-hidden mb-6" aria-labelledby="mobile-tokens-heading">
+    <div class="px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+      <h2 id="mobile-tokens-heading" class="text-lg font-semibold text-gray-900 dark:text-white">
+        <i class="fas fa-key text-yellow-500 mr-2" aria-hidden="true"></i>{{ _("devices.mobile_tokens_heading") }}
+      </h2>
+      <p class="text-sm text-gray-500 dark:text-gray-400 mt-1">{{ _("devices.mobile_tokens_description") }}</p>
+    </div>
+
+    <!-- Loading -->
+    <template x-if="loadingTokens">
+      <div class="p-8 text-center text-gray-500 dark:text-gray-400">
+        <i class="fas fa-spinner fa-spin text-2xl mb-2" aria-hidden="true"></i>
+        <p class="text-sm">{{ _("devices.loading") }}</p>
+      </div>
+    </template>
+
+    <!-- Empty state -->
+    <template x-if="!loadingTokens && mobileTokens.length === 0">
+      <div class="p-8 text-center text-gray-500 dark:text-gray-400">
+        <i class="fas fa-mobile-alt text-4xl mb-3 text-gray-300 dark:text-gray-600" aria-hidden="true"></i>
+        <p class="font-medium">{{ _("devices.no_mobile_tokens") }}</p>
+        <p class="text-sm mt-1">{{ _("devices.no_mobile_tokens_help") }}</p>
+      </div>
+    </template>
+
+    <!-- Tokens table -->
+    <template x-if="!loadingTokens && mobileTokens.length > 0">
+      <div class="overflow-x-auto">
+        <table class="w-full text-sm" aria-label="{{ _('devices.mobile_tokens_heading') }}">
+          <thead>
+            <tr class="bg-gray-50 dark:bg-gray-750 text-left">
+              <th scope="col" class="px-6 py-3 font-medium text-gray-500 dark:text-gray-400 uppercase text-xs tracking-wider">{{ _("devices.col_device") }}</th>
+              <th scope="col" class="px-6 py-3 font-medium text-gray-500 dark:text-gray-400 uppercase text-xs tracking-wider">{{ _("devices.col_token_prefix") }}</th>
+              <th scope="col" class="px-6 py-3 font-medium text-gray-500 dark:text-gray-400 uppercase text-xs tracking-wider">{{ _("devices.col_created") }}</th>
+              <th scope="col" class="px-6 py-3 font-medium text-gray-500 dark:text-gray-400 uppercase text-xs tracking-wider">{{ _("devices.col_last_used") }}</th>
+              <th scope="col" class="px-6 py-3 font-medium text-gray-500 dark:text-gray-400 uppercase text-xs tracking-wider">{{ _("devices.col_status") }}</th>
+              <th scope="col" class="px-6 py-3 font-medium text-gray-500 dark:text-gray-400 uppercase text-xs tracking-wider sr-only">{{ _("common.actions") }}</th>
+            </tr>
+          </thead>
+          <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
+            <template x-for="token in mobileTokens" :key="token.id">
+              <tr class="hover:bg-gray-50 dark:hover:bg-gray-750 transition-colors">
+                <td class="px-6 py-4 whitespace-nowrap">
+                  <div class="flex items-center gap-2">
+                    <i class="fas fa-mobile-alt text-gray-400" aria-hidden="true"></i>
+                    <span class="font-medium text-gray-900 dark:text-white" x-text="formatDeviceName(token.name)"></span>
+                  </div>
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap">
+                  <code class="bg-gray-100 dark:bg-gray-700 px-2 py-1 rounded text-xs font-mono" x-text="token.token_prefix + '…'"></code>
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap text-gray-500 dark:text-gray-400" x-text="formatDate(token.created_at)"></td>
+                <td class="px-6 py-4 whitespace-nowrap text-gray-500 dark:text-gray-400">
+                  <span x-text="token.last_used_at ? formatDate(token.last_used_at) : '—'"></span>
+                  <span x-show="token.last_used_ip" class="block text-xs text-gray-400 mt-0.5">
+                    <i class="fas fa-globe mr-1" aria-hidden="true"></i><span x-text="token.last_used_ip"></span>
+                  </span>
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap">
+                  <span
+                    class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium"
+                    :class="token.is_active ? 'bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400' : 'bg-red-100 text-red-800 dark:bg-red-900/30 dark:text-red-400'"
+                    x-text="token.is_active ? '{{ _('devices.status_active') }}' : '{{ _('devices.status_revoked') }}'"
+                  ></span>
+                </td>
+                <td class="px-6 py-4 whitespace-nowrap text-right">
+                  <button
+                    x-show="token.is_active"
+                    type="button"
+                    @click="revokeToken(token)"
+                    :disabled="revokingToken === token.id"
+                    class="inline-flex items-center px-3 py-1.5 text-sm font-medium text-red-600 hover:text-red-800
+                           dark:text-red-400 dark:hover:text-red-300 hover:bg-red-50 dark:hover:bg-red-900/20 rounded-md
+                           focus:outline-none focus:ring-2 focus:ring-red-500 disabled:opacity-50 transition-colors"
+                    style="min-height:36px; min-width:44px;"
+                    :aria-label="'{{ _('devices.revoke_token') }} ' + token.name"
+                  >
+                    <i :class="revokingToken === token.id ? 'fas fa-spinner fa-spin' : 'fas fa-sign-out-alt'" class="mr-1" aria-hidden="true"></i>
+                    {{ _("devices.revoke_token") }}
+                  </button>
+                </td>
+              </tr>
+            </template>
+          </tbody>
+        </table>
+      </div>
+    </template>
+
+    <!-- Error -->
+    <template x-if="tokenError">
+      <div class="m-4 bg-red-50 dark:bg-red-900/20 border border-red-200 dark:border-red-800 text-red-700 dark:text-red-400 p-3 rounded text-sm" role="alert">
+        <i class="fas fa-exclamation-triangle mr-1" aria-hidden="true"></i>
+        <span x-text="tokenError"></span>
+      </div>
+    </template>
+  </section>
+
+  <!-- ── Registered Devices (Push Notifications) ────────────────────────── -->
+  <section class="bg-white dark:bg-gray-800 shadow rounded-lg overflow-hidden mb-6" aria-labelledby="devices-heading">
+    <div class="px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+      <h2 id="devices-heading" class="text-lg font-semibold text-gray-900 dark:text-white">
+        <i class="fas fa-bell text-purple-500 mr-2" aria-hidden="true"></i>{{ _("devices.registered_devices_heading") }}
+      </h2>
+      <p class="text-sm text-gray-500 dark:text-gray-400 mt-1">{{ _("devices.registered_devices_description") }}</p>
+    </div>
+
+    <!-- Loading -->
+    <template x-if="loadingDevices">
+      <div class="p-8 text-center text-gray-500 dark:text-gray-400">
+        <i class="fas fa-spinner fa-spin text-2xl mb-2" aria-hidden="true"></i>
+        <p class="text-sm">{{ _("devices.loading") }}</p>
+      </div>
+    </template>
+
+    <!-- Empty state -->
+    <template x-if="!loadingDevices && devices.length === 0">
+      <div class="p-8 text-center text-gray-500 dark:text-gray-400">
+        <i class="fas fa-bell-slash text-4xl mb-3 text-gray-300 dark:text-gray-600" aria-hidden="true"></i>
+        <p class="font-medium">{{ _("devices.no_devices") }}</p>
+        <p class="text-sm mt-1">{{ _("devices.no_devices_help") }}</p>
+      </div>
+    </template>
+
+    <!-- Devices list -->
+    <template x-if="!loadingDevices && devices.length > 0">
+      <div class="divide-y divide-gray-200 dark:divide-gray-700">
+        <template x-for="device in devices" :key="device.id">
+          <div class="flex items-center justify-between px-6 py-4 hover:bg-gray-50 dark:hover:bg-gray-750 transition-colors">
+            <div class="flex items-center gap-3 min-w-0">
+              <i
+                :class="device.platform === 'ios' ? 'fab fa-apple' :
+                        device.platform === 'android' ? 'fab fa-android text-green-500' :
+                        'fas fa-globe'"
+                class="text-lg text-gray-400 flex-shrink-0"
+                aria-hidden="true"
+              ></i>
+              <div class="min-w-0">
+                <div class="text-sm font-medium text-gray-900 dark:text-white truncate">
+                  <span x-text="device.device_name || 'Unknown Device'"></span>
+                  <span
+                    class="ml-2 inline-flex items-center px-2 py-0.5 rounded text-xs font-medium"
+                    :class="device.is_active ? 'bg-green-100 text-green-800 dark:bg-green-900/30 dark:text-green-400' : 'bg-gray-100 text-gray-600 dark:bg-gray-700 dark:text-gray-400'"
+                    x-text="device.is_active ? '{{ _('devices.status_active') }}' : '{{ _('devices.status_inactive') }}'"
+                  ></span>
+                </div>
+                <div class="text-xs text-gray-500 dark:text-gray-400 space-x-3 mt-0.5">
+                  <span>
+                    <i class="fas fa-microchip mr-1" aria-hidden="true"></i>
+                    <span x-text="device.platform.charAt(0).toUpperCase() + device.platform.slice(1)"></span>
+                  </span>
+                  <span x-show="device.last_seen_at">
+                    <i class="fas fa-clock mr-1" aria-hidden="true"></i>{{ _("devices.col_last_seen") }}:
+                    <span x-text="formatDate(device.last_seen_at)"></span>
+                  </span>
+                  <span>
+                    <i class="fas fa-calendar mr-1" aria-hidden="true"></i>
+                    <span x-text="formatDate(device.created_at)"></span>
+                  </span>
+                </div>
+              </div>
+            </div>
+            <button
+              x-show="device.is_active"
+              type="button"
+              @click="deactivateDevice(device)"
+              :disabled="deactivatingDevice === device.id"
+              class="flex-shrink-0 inline-flex items-center px-3 py-1.5 text-sm font-medium text-red-600 hover:text-red-800
+                     dark:text-red-400 dark:hover:text-red-300 hover:bg-red-50 dark:hover:bg-red-900/20 rounded-md
+                     focus:outline-none focus:ring-2 focus:ring-red-500 disabled:opacity-50 transition-colors"
+              style="min-height:36px; min-width:44px;"
+              :aria-label="'{{ _('devices.deactivate_device') }} ' + (device.device_name || 'device')"
+            >
+              <i :class="deactivatingDevice === device.id ? 'fas fa-spinner fa-spin' : 'fas fa-trash-alt'" class="mr-1" aria-hidden="true"></i>
+              {{ _("devices.deactivate_device") }}
+            </button>
+          </div>
+        </template>
+      </div>
+    </template>
+
+    <!-- Error -->
+    <template x-if="deviceError">
+      <div class="m-4 bg-red-50 dark:bg-red-900/20 border border-red-200 dark:border-red-800 text-red-700 dark:text-red-400 p-3 rounded text-sm" role="alert">
+        <i class="fas fa-exclamation-triangle mr-1" aria-hidden="true"></i>
+        <span x-text="deviceError"></span>
+      </div>
+    </template>
+  </section>
+
+  <!-- ── QR Login CTA ───────────────────────────────────────────────────── -->
+  <div class="text-center">
+    <a
+      href="/qr-login"
+      class="inline-flex items-center px-5 py-2.5 bg-blue-600 hover:bg-blue-700 text-white text-sm font-medium
+             rounded-lg focus:outline-none focus:ring-2 focus:ring-blue-500 transition-colors"
+      style="min-height:44px;"
+    >
+      <i class="fas fa-qrcode mr-2" aria-hidden="true"></i>
+      {{ _("devices.qr_login_cta") }}
+    </a>
+  </div>
+
+  <!-- ── Status banner ──────────────────────────────────────────────────── -->
+  <div
+    x-show="banner.visible"
+    x-transition
+    class="mt-6 rounded-lg p-3 text-sm"
+    :class="banner.error
+      ? 'bg-red-50 dark:bg-red-900/30 text-red-800 dark:text-red-200 border border-red-300 dark:border-red-700'
+      : 'bg-green-50 dark:bg-green-900/30 text-green-800 dark:text-green-200 border border-green-300 dark:border-green-700'"
+    role="alert"
+    aria-live="polite"
+  >
+    <span x-text="banner.message"></span>
+  </div>
+</div>
+
+<script>
+function devicesPage() {
+  const csrfToken = '{{ csrf_token | default("") }}';
+  return {
+    mobileTokens: [],
+    devices: [],
+    loadingTokens: true,
+    loadingDevices: true,
+    revokingToken: null,
+    deactivatingDevice: null,
+    tokenError: null,
+    deviceError: null,
+    banner: { visible: false, error: false, message: '' },
+
+    async init() {
+      await Promise.all([this.loadMobileTokens(), this.loadDevices()]);
+    },
+
+    async loadMobileTokens() {
+      this.loadingTokens = true;
+      this.tokenError = null;
+      try {
+        const res = await fetch('/api/api-tokens/mobile', {
+          headers: { 'X-CSRF-Token': csrfToken },
+        });
+        if (!res.ok) throw new Error('Failed to load mobile tokens');
+        this.mobileTokens = await res.json();
+      } catch (e) {
+        this.tokenError = e.message;
+      } finally {
+        this.loadingTokens = false;
+      }
+    },
+
+    async loadDevices() {
+      this.loadingDevices = true;
+      this.deviceError = null;
+      try {
+        const res = await fetch('/api/mobile/devices', {
+          headers: { 'X-CSRF-Token': csrfToken },
+        });
+        if (!res.ok) throw new Error('Failed to load devices');
+        this.devices = await res.json();
+      } catch (e) {
+        this.deviceError = e.message;
+      } finally {
+        this.loadingDevices = false;
+      }
+    },
+
+    async revokeToken(token) {
+      if (!confirm({{ _("devices.confirm_revoke_token") | tojson }})) return;
+      this.revokingToken = token.id;
+      try {
+        const res = await fetch(`/api/api-tokens/${token.id}`, {
+          method: 'DELETE',
+          headers: { 'X-CSRF-Token': csrfToken },
+        });
+        if (!res.ok) {
+          const data = await res.json().catch(() => ({}));
+          throw new Error(data.detail || 'Failed to revoke token');
+        }
+        await this.loadMobileTokens();
+        this._showBanner({{ _("devices.token_revoked_success") | tojson }}, false);
+      } catch (e) {
+        this._showBanner(e.message, true);
+      } finally {
+        this.revokingToken = null;
+      }
+    },
+
+    async deactivateDevice(device) {
+      if (!confirm({{ _("devices.confirm_deactivate_device") | tojson }})) return;
+      this.deactivatingDevice = device.id;
+      try {
+        const res = await fetch(`/api/mobile/devices/${device.id}`, {
+          method: 'DELETE',
+          headers: { 'X-CSRF-Token': csrfToken },
+        });
+        if (!res.ok && res.status !== 204) {
+          const data = await res.json().catch(() => ({}));
+          throw new Error(data.detail || 'Failed to remove device');
+        }
+        await this.loadDevices();
+        this._showBanner({{ _("devices.device_removed_success") | tojson }}, false);
+      } catch (e) {
+        this._showBanner(e.message, true);
+      } finally {
+        this.deactivatingDevice = null;
+      }
+    },
+
+    /** Extract the device name from the full token name (e.g. "Mobile App – iPhone 15 Pro" → "iPhone 15 Pro"). */
+    formatDeviceName(name) {
+      if (!name) return 'Unknown Device';
+      // Match either em dash (–) or hyphen (-) separators used by the mobile flows.
+      const match = name.match(/[–\-]\s*(.+)$/);
+      return match ? match[1].trim() : name;
+    },
+
+    formatDate(d) {
+      if (!d) return '—';
+      const dt = new Date(d);
+      return dt.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' }) +
+        ' ' + dt.toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' });
+    },
+
+    _showBanner(msg, isError) {
+      this.banner = { visible: true, error: isError, message: msg };
+      setTimeout(() => { this.banner.visible = false; }, 5000);
+    },
+  };
+}
+</script>
+{% endblock %}

frontend/templates/file_detail.html

@@ -1095,10 +1095,18 @@
 
 {% block content %}
 <div class="detail-container">
-  <a href="/files" class="back-button" aria-label="Back to File List">
-    <i class="fas fa-arrow-left" aria-hidden="true"></i>
-    Back to File List
-  </a>
+  <div style="display:flex;align-items:center;gap:1rem;margin-bottom:1.5rem;flex-wrap:wrap;">
+    <a href="/files" class="back-button" style="margin-bottom:0;" aria-label="Back to File List">
+      <i class="fas fa-arrow-left" aria-hidden="true"></i>
+      Back to File List
+    </a>
+    {% if file %}
+    <a href="/files/{{ file.id }}" class="back-button" style="margin-bottom:0;" aria-label="View document for {{ file.original_filename }}">
+      <i class="fas fa-eye" aria-hidden="true"></i>
+      View Document
+    </a>
+    {% endif %}
+  </div>
 
   {% if error %}
   <div class="error-message">

frontend/templates/file_view.html

@@ -439,10 +439,105 @@
         </button>
       </div>
     </div>
+    {% if file.detected_language %}
+    <div style="font-size:0.75rem;color:#6b7280;margin-bottom:0.5rem;">
+      <i class="fas fa-globe" aria-hidden="true" style="margin-right:0.25rem;"></i>
+      Detected language: <strong>{{ file.detected_language }}</strong>
+    </div>
+    {% endif %}
     <div id="ocr-text-block" style="display:none;">
       <pre class="ocr-text" id="ocr-text-content">{{ file.ocr_text }}</pre>
     </div>
   </div>
+
+  <!-- ── Default-language translation ── -->
+  {% if file.default_language_text %}
+  <div class="doc-card">
+    <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:0.75rem;">
+      <div class="doc-card-title" style="margin:0;">
+        <i class="fas fa-language" aria-hidden="true" style="color:#3b82f6;margin-right:0.4rem;"></i>
+        Default Language Version
+        {% if file.default_language_code %}
+        <span style="font-size:0.75rem;color:#6b7280;font-weight:normal;margin-left:0.5rem;">({{ file.default_language_code }})</span>
+        {% endif %}
+      </div>
+      <div style="display:flex;gap:0.5rem;">
+        <button class="text-toggle" onclick="toggleDefaultLangText()" aria-expanded="false" aria-controls="default-lang-text-block">
+          <i id="default-lang-toggle-icon" class="fas fa-chevron-down" aria-hidden="true"></i>
+          <span id="default-lang-toggle-label">Show text</span>
+        </button>
+        <button class="text-toggle" onclick="copyDefaultLangText()" id="default-lang-copy-btn" style="color:#10b981;" aria-label="Copy default language text">
+          <i class="fas fa-copy" aria-hidden="true"></i> Copy
+        </button>
+      </div>
+    </div>
+    <div id="default-lang-text-block" style="display:none;">
+      <pre class="ocr-text" id="default-lang-text-content">{{ file.default_language_text }}</pre>
+    </div>
+  </div>
+  {% elif file.detected_language %}
+  <!-- Translation pending or document already in default language -->
+  <div class="doc-card">
+    <div style="display:flex;justify-content:space-between;align-items:center;">
+      <div class="doc-card-title" style="margin:0;">
+        <i class="fas fa-language" aria-hidden="true" style="color:#3b82f6;margin-right:0.4rem;"></i>
+        Default Language Version
+      </div>
+      <button class="action-btn btn-secondary" onclick="loadDefaultLangText({{ file.id }})">
+        <i class="fas fa-language" aria-hidden="true"></i> Load translation
+      </button>
+    </div>
+    <div id="default-lang-load-area" style="margin-top:0.75rem;"></div>
+  </div>
+  {% endif %}
+
+  <!-- ── On-the-fly translation ── -->
+  {% if file.ocr_text %}
+  <div class="doc-card">
+    <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:0.75rem;">
+      <div class="doc-card-title" style="margin:0;">
+        <i class="fas fa-exchange-alt" aria-hidden="true" style="color:#f59e0b;margin-right:0.4rem;"></i>
+        Translate to Another Language
+      </div>
+    </div>
+    <div style="display:flex;gap:0.5rem;align-items:center;flex-wrap:wrap;">
+      <label for="translate-lang-select" class="sr-only">Target language</label>
+      <select id="translate-lang-select" style="padding:0.4rem 0.6rem;border:1px solid #d1d5db;border-radius:0.375rem;font-size:0.85rem;min-width:160px;" aria-label="Select target language for translation">
+        <option value="">Select language…</option>
+        <option value="en">English</option>
+        <option value="de">Deutsch</option>
+        <option value="fr">Français</option>
+        <option value="es">Español</option>
+        <option value="it">Italiano</option>
+        <option value="pt">Português</option>
+        <option value="nl">Nederlands</option>
+        <option value="pl">Polski</option>
+        <option value="ru">Русский</option>
+        <option value="zh">中文</option>
+        <option value="ja">日本語</option>
+        <option value="ko">한국어</option>
+        <option value="ar">العربية</option>
+        <option value="hi">हिन्दी</option>
+        <option value="tr">Türkçe</option>
+        <option value="sv">Svenska</option>
+        <option value="da">Dansk</option>
+        <option value="no">Norsk</option>
+        <option value="fi">Suomi</option>
+        <option value="cs">Čeština</option>
+        <option value="ro">Română</option>
+        <option value="uk">Українська</option>
+      </select>
+      <button class="action-btn btn-secondary" onclick="translateOnTheFly({{ file.id }})" id="translate-btn" style="min-height:44px;min-width:44px;">
+        <i class="fas fa-language" aria-hidden="true"></i> Translate
+      </button>
+      <button class="text-toggle" onclick="copyTranslatedText()" id="translate-copy-btn" style="color:#10b981;display:none;" aria-label="Copy translated text">
+        <i class="fas fa-copy" aria-hidden="true"></i> Copy
+      </button>
+    </div>
+    <div id="translate-result-area" style="margin-top:0.75rem;"></div>
+  </div>
+  {% endif %}
+
   {% elif processed_file_exists or original_file_exists %}
   <div class="doc-card">
     <div style="display:flex;justify-content:space-between;align-items:center;">
@@ -688,6 +783,149 @@
     });
   }
 
+  // ── Default-language text toggle ──
+  function toggleDefaultLangText() {
+    var block = document.getElementById('default-lang-text-block');
+    var icon  = document.getElementById('default-lang-toggle-icon');
+    var label = document.getElementById('default-lang-toggle-label');
+    var btn   = icon ? icon.closest('button') : null;
+    if (!block) return;
+    if (block.style.display === 'none') {
+      block.style.display = 'block';
+      if (icon) icon.className = 'fas fa-chevron-up';
+      if (label) label.textContent = 'Hide text';
+      if (btn) btn.setAttribute('aria-expanded', 'true');
+    } else {
+      block.style.display = 'none';
+      if (icon) icon.className = 'fas fa-chevron-down';
+      if (label) label.textContent = 'Show text';
+      if (btn) btn.setAttribute('aria-expanded', 'false');
+    }
+  }
+
+  // ── Copy default-language text ──
+  function copyDefaultLangText() {
+    var content = document.getElementById('default-lang-text-content');
+    if (!content) return;
+    var text = content.textContent;
+    var btn = document.getElementById('default-lang-copy-btn');
+    if (!btn) return;
+    var orig = btn.innerHTML;
+    navigator.clipboard.writeText(text).then(function() {
+      btn.innerHTML = '<i class="fas fa-check"></i> Copied!';
+      setTimeout(function() { btn.innerHTML = orig; }, 2000);
+    }).catch(function() {
+      try {
+        var ta = document.createElement('textarea');
+        ta.value = text;
+        ta.style.cssText = 'position:fixed;opacity:0;';
+        document.body.appendChild(ta);
+        ta.select();
+        document.execCommand('copy');
+        document.body.removeChild(ta);
+        btn.innerHTML = '<i class="fas fa-check"></i> Copied!';
+        setTimeout(function() { btn.innerHTML = orig; }, 2000);
+      } catch(e) {}
+    });
+  }
+
+  // ── Load default-language text on demand ──
+  function loadDefaultLangText(fileId) {
+    var area = document.getElementById('default-lang-load-area');
+    if (!area) return;
+    area.innerHTML = '<div style="text-align:center;padding:1.5rem;color:#6b7280;"><i class="fas fa-spinner fa-spin fa-2x" aria-hidden="true"></i><p style="margin-top:0.5rem;">Loading translation…</p></div>';
+    fetch('/files/' + fileId + '/text/default-language')
+      .then(function(r) {
+        if (r.status === 404) throw new Error('No translation available yet — it may still be processing');
+        if (!r.ok) throw new Error('HTTP ' + r.status);
+        return r.json();
+      })
+      .then(function(data) {
+        area.innerHTML = '';
+        var info = document.createElement('div');
+        info.style.cssText = 'font-size:0.75rem;color:#6b7280;margin-bottom:0.5rem;';
+        info.textContent = 'Translated to: ' + data.language_code + (data.detected_language ? ' (from ' + data.detected_language + ')' : '');
+        area.appendChild(info);
+        var pre = document.createElement('pre');
+        pre.className = 'ocr-text';
+        pre.textContent = data.text;
+        area.appendChild(pre);
+      })
+      .catch(function(err) {
+        area.innerHTML = '<div style="color:#92400e;padding:0.75rem;background:#fef3c7;border-radius:0.375rem;font-size:0.875rem;"><i class="fas fa-info-circle" aria-hidden="true"></i> ' + err.message + '</div>';
+      });
+  }
+
+  // ── On-the-fly translation ──
+  var _translateCache = {};
+  function translateOnTheFly(fileId) {
+    var select = document.getElementById('translate-lang-select');
+    var area = document.getElementById('translate-result-area');
+    var copyBtn = document.getElementById('translate-copy-btn');
+    if (!select || !area) return;
+    var lang = select.value;
+    if (!lang) { area.innerHTML = '<div style="color:#92400e;padding:0.75rem;background:#fef3c7;border-radius:0.375rem;font-size:0.875rem;">Please select a target language.</div>'; return; }
+
+    // Check cache
+    if (_translateCache[lang]) {
+      renderTranslation(area, _translateCache[lang], lang);
+      if (copyBtn) copyBtn.style.display = '';
+      return;
+    }
+
+    area.innerHTML = '<div style="text-align:center;padding:1.5rem;color:#6b7280;" aria-live="polite"><i class="fas fa-spinner fa-spin fa-2x" aria-hidden="true"></i><p style="margin-top:0.5rem;">Translating…</p></div>';
+    if (copyBtn) copyBtn.style.display = 'none';
+
+    fetch('/api/files/' + fileId + '/translate?lang=' + encodeURIComponent(lang))
+      .then(function(r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.json(); })
+      .then(function(data) {
+        _translateCache[lang] = data.text;
+        renderTranslation(area, data.text, lang);
+        if (copyBtn) copyBtn.style.display = '';
+      })
+      .catch(function(err) {
+        area.innerHTML = '<div style="color:#dc2626;padding:0.75rem;background:#fee2e2;border-radius:0.375rem;font-size:0.875rem;"><i class="fas fa-exclamation-triangle" aria-hidden="true"></i> Translation failed: ' + err.message + '</div>';
+      });
+  }
+
+  function renderTranslation(container, text, lang) {
+    container.innerHTML = '';
+    var info = document.createElement('div');
+    info.style.cssText = 'font-size:0.75rem;color:#6b7280;margin-bottom:0.5rem;';
+    info.textContent = 'Translated to: ' + lang;
+    container.appendChild(info);
+    var pre = document.createElement('pre');
+    pre.className = 'ocr-text';
+    pre.id = 'translated-text-content';
+    pre.textContent = text;
+    container.appendChild(pre);
+  }
+
+  function copyTranslatedText() {
+    var content = document.getElementById('translated-text-content');
+    if (!content) return;
+    var text = content.textContent;
+    var btn = document.getElementById('translate-copy-btn');
+    if (!btn) return;
+    var orig = btn.innerHTML;
+    navigator.clipboard.writeText(text).then(function() {
+      btn.innerHTML = '<i class="fas fa-check"></i> Copied!';
+      setTimeout(function() { btn.innerHTML = orig; }, 2000);
+    }).catch(function() {
+      try {
+        var ta = document.createElement('textarea');
+        ta.value = text;
+        ta.style.cssText = 'position:fixed;opacity:0;';
+        document.body.appendChild(ta);
+        ta.select();
+        document.execCommand('copy');
+        document.body.removeChild(ta);
+        btn.innerHTML = '<i class="fas fa-check"></i> Copied!';
+        setTimeout(function() { btn.innerHTML = orig; }, 2000);
+      } catch(e) {}
+    });
+  }
+
   // ── Initialise on load ──
   document.addEventListener('DOMContentLoaded', function() {
     {% if (processed_file_exists or original_file_exists) and file %}

frontend/templates/filemanager.html

@@ -1,5 +1,5 @@
 {% extends "base.html" %}
-{% block title %}File Manager – Admin{% endblock %}
+{% block title %}{{ _("admin_files.page_title") }}{% endblock %}
 
 {% block content %}
 <div class="container mx-auto px-4 py-8">
@@ -8,9 +8,9 @@
   <div class="mb-6 flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
     <div>
       <h1 class="text-3xl font-bold text-gray-900 flex items-center gap-2">
-        <i class="fas fa-folder-open text-blue-500"></i>
-        File Manager
-        <span class="text-xs font-semibold text-red-600 bg-red-50 border border-red-200 rounded px-2 py-0.5 ml-1">Admin Only</span>
+        <i class="fas fa-folder-open text-blue-500" aria-hidden="true"></i>
+        {{ _("admin_files.heading") }}
+        <span class="text-xs font-semibold text-red-600 bg-red-50 border border-red-200 rounded px-2 py-0.5 ml-1">{{ _("admin_files.admin_only_badge") }}</span>
       </h1>
       <p class="text-gray-400 text-sm mt-1">
         <code class="bg-gray-100 rounded px-1 text-xs">{{ workdir }}</code>
@@ -19,15 +19,15 @@
     <!-- Summary badges -->
     <div class="flex gap-3 text-sm flex-wrap">
       <span class="inline-flex items-center gap-1.5 bg-blue-50 border border-blue-200 text-blue-700 rounded-full px-3 py-1">
-        <i class="fas fa-hdd text-xs"></i>
-        {% if total_disk is none %}…{% else %}{{ total_disk }}{% endif %} on disk
+        <i class="fas fa-hdd text-xs" aria-hidden="true"></i>
+        {% if total_disk is none %}…{% else %}{{ total_disk }}{% endif %} {{ _("admin_files.badge_on_disk") }}
       </span>
       <span class="inline-flex items-center gap-1.5 bg-green-50 border border-green-200 text-green-700 rounded-full px-3 py-1">
-        <i class="fas fa-database text-xs"></i> {{ total_db }} in DB
+        <i class="fas fa-database text-xs" aria-hidden="true"></i> {{ total_db }} {{ _("admin_files.badge_in_db") }}
       </span>
       {% if total_disk is not none and total_disk != total_db %}
       <span class="inline-flex items-center gap-1.5 bg-amber-50 border border-amber-300 text-amber-700 rounded-full px-3 py-1 font-medium">
-        <i class="fas fa-triangle-exclamation text-xs"></i> Delta detected
+        <i class="fas fa-triangle-exclamation text-xs" aria-hidden="true"></i> {{ _("admin_files.badge_delta_detected") }}
       </span>
       {% endif %}
     </div>
@@ -38,17 +38,17 @@
     <a href="?view=filesystem"
        class="tab-link px-5 py-2.5 text-sm font-medium rounded-t border-b-2 transition
               {% if view == 'filesystem' %}border-blue-600 text-blue-600 bg-blue-50{% else %}border-transparent text-gray-500 hover:text-gray-700 hover:border-gray-300{% endif %}">
-      <i class="fas fa-folder-tree mr-1.5"></i>Filesystem
+      <i class="fas fa-folder-tree mr-1.5" aria-hidden="true"></i>{{ _("admin_files.tab_filesystem") }}
     </a>
     <a href="?view=database"
        class="tab-link px-5 py-2.5 text-sm font-medium rounded-t border-b-2 transition
               {% if view == 'database' %}border-green-600 text-green-600 bg-green-50{% else %}border-transparent text-gray-500 hover:text-gray-700 hover:border-gray-300{% endif %}">
-      <i class="fas fa-database mr-1.5"></i>Database Records
+      <i class="fas fa-database mr-1.5" aria-hidden="true"></i>{{ _("admin_files.tab_database") }}
     </a>
     <a href="?view=reconcile"
        class="tab-link px-5 py-2.5 text-sm font-medium rounded-t border-b-2 transition
               {% if view == 'reconcile' %}border-amber-500 text-amber-600 bg-amber-50{% else %}border-transparent text-gray-500 hover:text-gray-700 hover:border-gray-300{% endif %}">
-      <i class="fas fa-code-compare mr-1.5"></i>Reconcile
+      <i class="fas fa-code-compare mr-1.5" aria-hidden="true"></i>{{ _("admin_files.tab_reconcile") }}
       {% if total_disk != total_db %}
         <span class="ml-1 bg-amber-500 text-white rounded-full text-xs px-1.5 py-0.5">!</span>
       {% endif %}
@@ -62,21 +62,21 @@
 
   <!-- Legend -->
   <div class="flex flex-wrap gap-4 text-xs text-gray-500 mb-4">
-    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-green-400 inline-block"></span> Found in DB</span>
-    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-amber-400 inline-block"></span> Not in DB (orphan)</span>
+    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-green-400 inline-block"></span> {{ _("admin_files.legend_found_in_db") }}</span>
+    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-amber-400 inline-block"></span> {{ _("admin_files.legend_not_in_db") }}</span>
   </div>
 
   <!-- Breadcrumb -->
-  <nav class="flex mb-4 text-sm" aria-label="Breadcrumb">
+  <nav class="flex mb-4 text-sm" aria-label="{{ _("admin_files.aria_breadcrumb") }}">
     <ol class="inline-flex items-center space-x-1 flex-wrap">
       <li>
         <a href="?view=filesystem" class="text-blue-600 hover:underline flex items-center gap-1">
-          <i class="fas fa-home"></i> workdir
+          <i class="fas fa-home" aria-hidden="true"></i> {{ _("admin_files.breadcrumb_workdir") }}
         </a>
       </li>
       {% for crumb in breadcrumbs %}
       <li class="flex items-center">
-        <i class="fas fa-chevron-right text-gray-300 mx-1 text-xs"></i>
+        <i class="fas fa-chevron-right text-gray-300 mx-1 text-xs" aria-hidden="true"></i>
         {% if loop.last %}
           <span class="text-gray-700 font-medium">{{ crumb.name }}</span>
         {% else %}
@@ -93,22 +93,22 @@
       <thead class="bg-gray-50">
         <tr>
           <th class="px-4 py-3 text-left w-8"></th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs">Name</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs hidden sm:table-cell">Size</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs hidden md:table-cell">Modified</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs">DB</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs">Actions</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs">{{ _("admin_files.col_name") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs hidden sm:table-cell">{{ _("admin_files.col_size") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs hidden md:table-cell">{{ _("admin_files.col_modified") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs">{{ _("admin_files.col_db") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-600 uppercase tracking-wider text-xs">{{ _("admin_files.col_actions") }}</th>
         </tr>
       </thead>
       <tbody class="divide-y divide-gray-100">
 
         {% if current_path %}
         <tr class="hover:bg-gray-50">
-          <td class="px-4 py-3 text-yellow-400"><i class="fas fa-folder"></i></td>
+          <td class="px-4 py-3 text-yellow-400"><i class="fas fa-folder" aria-hidden="true"></i></td>
           <td class="px-4 py-3 font-medium text-gray-900" colspan="4">
             <a href="?view=filesystem{% if parent_path %}&path={{ parent_path | urlencode }}{% endif %}"
                class="text-blue-600 hover:underline flex items-center gap-1">
-              <i class="fas fa-level-up-alt text-xs"></i> ..
+              <i class="fas fa-level-up-alt text-xs" aria-hidden="true"></i> ..
             </a>
           </td>
           <td></td>
@@ -118,7 +118,7 @@
         {% if fs_entries %}
           {% for entry in fs_entries %}
           <tr class="hover:bg-gray-50 {% if entry.db_status == 'orphan' %}bg-amber-50{% endif %}">
-            <td class="px-4 py-3"><i class="{{ entry.icon }}"></i></td>
+            <td class="px-4 py-3"><i class="{{ entry.icon }}" aria-hidden="true"></i></td>
             <td class="px-4 py-3 font-medium text-gray-900 max-w-xs truncate">
               {% if entry.is_dir %}
                 <a href="?view=filesystem&path={{ entry.rel_path | urlencode }}" class="text-blue-600 hover:underline">
@@ -133,11 +133,11 @@
             <td class="px-4 py-3">
               {% if entry.db_status == 'in_db' %}
                 <span class="inline-flex items-center gap-1 text-xs text-green-700 bg-green-50 border border-green-200 rounded-full px-2 py-0.5">
-                  <span class="h-1.5 w-1.5 rounded-full bg-green-500"></span> In DB
+                  <span class="h-1.5 w-1.5 rounded-full bg-green-500"></span> {{ _("admin_files.status_in_db") }}
                 </span>
               {% elif entry.db_status == 'orphan' %}
                 <span class="inline-flex items-center gap-1 text-xs text-amber-700 bg-amber-50 border border-amber-200 rounded-full px-2 py-0.5">
-                  <span class="h-1.5 w-1.5 rounded-full bg-amber-500"></span> Orphan
+                  <span class="h-1.5 w-1.5 rounded-full bg-amber-500"></span> {{ _("admin_files.status_orphan") }}
                 </span>
               {% endif %}
             </td>
@@ -145,7 +145,7 @@
               {% if not entry.is_dir %}
                 <a href="/admin/files/download?path={{ entry.rel_path | urlencode }}"
                    class="inline-flex items-center gap-1 px-2.5 py-1 border border-gray-200 text-xs font-medium rounded text-gray-600 bg-white hover:bg-gray-50">
-                  <i class="fas fa-download text-xs"></i> Download
+                  <i class="fas fa-download text-xs" aria-hidden="true"></i> {{ _("admin_files.btn_download") }}
                 </a>
               {% endif %}
             </td>
@@ -154,8 +154,8 @@
         {% else %}
           <tr>
             <td colspan="6" class="px-6 py-10 text-center text-sm text-gray-400">
-              <i class="fas fa-folder-open text-gray-200 text-3xl mb-2 block"></i>
-              This directory is empty.
+              <i class="fas fa-folder-open text-gray-200 text-3xl mb-2 block" aria-hidden="true"></i>
+              {{ _("admin_files.empty_directory") }}
             </td>
           </tr>
         {% endif %}
@@ -171,9 +171,9 @@
 
   <!-- Legend -->
   <div class="flex flex-wrap gap-4 text-xs text-gray-500 mb-4">
-    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-green-400 inline-block"></span> File exists on disk</span>
-    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-red-400 inline-block"></span> File missing from disk</span>
-    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-gray-300 inline-block"></span> Path not set</span>
+    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-green-400 inline-block"></span> {{ _("admin_files.legend_file_exists") }}</span>
+    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-red-400 inline-block"></span> {{ _("admin_files.legend_file_missing") }}</span>
+    <span class="flex items-center gap-1"><span class="h-2.5 w-2.5 rounded-full bg-gray-300 inline-block"></span> {{ _("admin_files.legend_path_not_set") }}</span>
   </div>
 
   {% if db_records %}
@@ -181,14 +181,14 @@
     <table class="min-w-full divide-y divide-gray-200 text-sm">
       <thead class="bg-gray-50">
         <tr>
-          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">ID</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">Original Filename</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden md:table-cell">Size</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden lg:table-cell">Ingested</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">local_filename</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">original_file_path</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">processed_file_path</th>
-          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">Health</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_id") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_original_filename") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden md:table-cell">{{ _("admin_files.col_size") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden lg:table-cell">{{ _("admin_files.col_ingested") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_local_filename") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_original_file_path") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_processed_file_path") }}</th>
+          <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_health") }}</th>
         </tr>
       </thead>
       <tbody class="divide-y divide-gray-100">
@@ -197,7 +197,7 @@
           <td class="px-4 py-3 text-gray-400 font-mono text-xs">{{ rec.id }}</td>
           <td class="px-4 py-3 font-medium text-gray-800 max-w-xs truncate" title="{{ rec.original_filename }}">
             {% if rec.is_duplicate %}
-              <span class="text-xs text-purple-600 bg-purple-50 border border-purple-200 rounded px-1 mr-1">dup</span>
+              <span class="text-xs text-purple-600 bg-purple-50 border border-purple-200 rounded px-1 mr-1">{{ _("admin_files.badge_duplicate") }}</span>
             {% endif %}
             {{ rec.original_filename }}
           </td>
@@ -226,11 +226,11 @@
           <td class="px-4 py-3">
             {% if rec.health == 'ok' %}
               <span class="inline-flex items-center gap-1 text-xs text-green-700 bg-green-50 border border-green-200 rounded-full px-2 py-0.5">
-                <i class="fas fa-check text-xs"></i> OK
+                <i class="fas fa-check text-xs" aria-hidden="true"></i> {{ _("admin_files.health_ok") }}
               </span>
             {% else %}
               <span class="inline-flex items-center gap-1 text-xs text-red-700 bg-red-50 border border-red-200 rounded-full px-2 py-0.5">
-                <i class="fas fa-triangle-exclamation text-xs"></i> Missing
+                <i class="fas fa-triangle-exclamation text-xs" aria-hidden="true"></i> {{ _("admin_files.health_missing") }}
               </span>
             {% endif %}
           </td>
@@ -241,8 +241,8 @@
   </div>
   {% else %}
   <div class="bg-white rounded-lg shadow p-10 text-center text-gray-400">
-    <i class="fas fa-database text-4xl mb-3 block text-gray-200"></i>
-    No file records found in the database.
+    <i class="fas fa-database text-4xl mb-3 block text-gray-200" aria-hidden="true"></i>
+    {{ _("admin_files.empty_database") }}
   </div>
   {% endif %}
   {% endif %}
@@ -254,17 +254,16 @@
 
   {% if orphan_files or ghost_records %}
   <div class="bg-amber-50 border border-amber-300 rounded-lg px-5 py-4 mb-6 flex items-start gap-3">
-    <i class="fas fa-triangle-exclamation text-amber-500 mt-0.5"></i>
+    <i class="fas fa-triangle-exclamation text-amber-500 mt-0.5" aria-hidden="true"></i>
     <div class="text-sm text-amber-800">
-      <strong>Delta detected.</strong>
-      Found <strong>{{ orphan_files | length }}</strong> orphan file(s) on disk with no DB record,
-      and <strong>{{ ghost_records | length }}</strong> DB record(s) with missing files on disk.
+      <strong>{{ _("admin_files.delta_detected_title") }}</strong>
+      {{ _("admin_files.delta_detected_detail", orphan_count=(orphan_files | length), ghost_count=(ghost_records | length)) }}
     </div>
   </div>
   {% else %}
   <div class="bg-green-50 border border-green-300 rounded-lg px-5 py-4 mb-6 flex items-center gap-3">
-    <i class="fas fa-circle-check text-green-500"></i>
-    <span class="text-sm text-green-800 font-medium">No delta found — filesystem and database are in sync.</span>
+    <i class="fas fa-circle-check text-green-500" aria-hidden="true"></i>
+    <span class="text-sm text-green-800 font-medium">{{ _("admin_files.no_delta") }}</span>
   </div>
   {% endif %}
 
@@ -272,7 +271,7 @@
   <div class="mb-8">
     <h2 class="text-base font-semibold text-gray-800 mb-3 flex items-center gap-2">
       <span class="h-3 w-3 rounded-full bg-amber-400 inline-block"></span>
-      Orphan files <span class="text-gray-400 font-normal text-sm ml-1">(on disk, no DB record)</span>
+      {{ _("admin_files.orphan_files_heading") }} <span class="text-gray-400 font-normal text-sm ml-1">{{ _("admin_files.orphan_files_desc") }}</span>
       <span class="text-xs bg-amber-100 text-amber-700 border border-amber-200 rounded-full px-2 py-0.5 ml-auto">{{ orphan_files | length }}</span>
     </h2>
     {% if orphan_files %}
@@ -281,23 +280,23 @@
         <thead class="bg-amber-50">
           <tr>
             <th class="px-4 py-3 text-left w-8"></th>
-            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">Path (relative to workdir)</th>
-            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden sm:table-cell">Size</th>
-            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden md:table-cell">Modified</th>
-            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">Actions</th>
+            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_path_relative") }}</th>
+            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden sm:table-cell">{{ _("admin_files.col_size") }}</th>
+            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden md:table-cell">{{ _("admin_files.col_modified") }}</th>
+            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_actions") }}</th>
           </tr>
         </thead>
         <tbody class="divide-y divide-gray-100">
           {% for f in orphan_files %}
           <tr class="hover:bg-amber-50">
-            <td class="px-4 py-3"><i class="{{ f.icon }}"></i></td>
+            <td class="px-4 py-3"><i class="{{ f.icon }}" aria-hidden="true"></i></td>
             <td class="px-4 py-3 font-mono text-xs text-amber-800 max-w-xs truncate" title="{{ f.rel_path }}">{{ f.rel_path }}</td>
             <td class="px-4 py-3 text-gray-500 hidden sm:table-cell">{{ f.size }}</td>
             <td class="px-4 py-3 text-gray-400 text-xs hidden md:table-cell">{{ f.modified }}</td>
             <td class="px-4 py-3">
               <a href="/admin/files/download?path={{ f.rel_path | urlencode }}"
                  class="inline-flex items-center gap-1 px-2.5 py-1 border border-gray-200 text-xs font-medium rounded text-gray-600 bg-white hover:bg-gray-50">
-                <i class="fas fa-download text-xs"></i> Download
+                <i class="fas fa-download text-xs" aria-hidden="true"></i> {{ _("admin_files.btn_download") }}
               </a>
             </td>
           </tr>
@@ -306,7 +305,7 @@
       </table>
     </div>
     {% else %}
-    <p class="text-sm text-gray-400 italic">No orphan files found.</p>
+    <p class="text-sm text-gray-400 italic">{{ _("admin_files.no_orphan_files") }}</p>
     {% endif %}
   </div>
 
@@ -314,7 +313,7 @@
   <div>
     <h2 class="text-base font-semibold text-gray-800 mb-3 flex items-center gap-2">
       <span class="h-3 w-3 rounded-full bg-red-400 inline-block"></span>
-      Ghost records <span class="text-gray-400 font-normal text-sm ml-1">(in DB, file(s) missing on disk)</span>
+      {{ _("admin_files.ghost_records_heading") }} <span class="text-gray-400 font-normal text-sm ml-1">{{ _("admin_files.ghost_records_desc") }}</span>
       <span class="text-xs bg-red-100 text-red-700 border border-red-200 rounded-full px-2 py-0.5 ml-auto">{{ ghost_records | length }}</span>
     </h2>
     {% if ghost_records %}
@@ -322,10 +321,10 @@
       <table class="min-w-full divide-y divide-gray-200 text-sm">
         <thead class="bg-red-50">
           <tr>
-            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">ID</th>
-            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">Original Filename</th>
-            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden md:table-cell">Ingested</th>
-            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">Missing paths</th>
+            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_id") }}</th>
+            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_original_filename") }}</th>
+            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs hidden md:table-cell">{{ _("admin_files.col_ingested") }}</th>
+            <th class="px-4 py-3 text-left font-semibold text-gray-500 uppercase tracking-wider text-xs">{{ _("admin_files.col_missing_paths") }}</th>
           </tr>
         </thead>
         <tbody class="divide-y divide-gray-100">
@@ -352,7 +351,7 @@
       </table>
     </div>
     {% else %}
-    <p class="text-sm text-gray-400 italic">No ghost records found.</p>
+    <p class="text-sm text-gray-400 italic">{{ _("admin_files.no_ghost_records") }}</p>
     {% endif %}
   </div>
   {% endif %}

frontend/templates/files.html

@@ -524,6 +524,7 @@
           <option value="webdav" {% if storage_provider == "webdav" %}selected{% endif %}>WebDAV</option>
           <option value="ftp" {% if storage_provider == "ftp" %}selected{% endif %}>FTP</option>
           <option value="sftp" {% if storage_provider == "sftp" %}selected{% endif %}>SFTP</option>
+          <option value="sharepoint" {% if storage_provider == "sharepoint" %}selected{% endif %}>SharePoint</option>
           <option value="icloud" {% if storage_provider == "icloud" %}selected{% endif %}>iCloud Drive</option>
         </select>
       </div>
@@ -716,19 +717,19 @@
           <td>{{ file.mime_type }}</td>
           <td>
             <span class="status-badge status-{{ file.processing_status }}">
-              {{ file.processing_status | title }}
+              {% if file.processing_status == 'pending' %}{{ _("common.pending") }}{% elif file.processing_status == 'processing' %}{{ _("common.processing") }}{% elif file.processing_status == 'completed' %}{{ _("common.completed") }}{% elif file.processing_status == 'failed' %}{{ _("common.failed") }}{% elif file.processing_status == 'duplicate' %}{{ _("files.status_duplicate") }}{% else %}{{ file.processing_status | title }}{% endif %}
             </span>
           </td>
-          <td>{{ file.created_at.strftime('%Y-%m-%d %H:%M:%S') if file.created_at else 'N/A' }}</td>
+          <td>{{ file.created_at.strftime('%Y-%m-%d %H:%M:%S') if file.created_at else _('common.not_available') }}</td>
           <td>
             <div style="display: flex; align-items: center;">
-              <button onclick="openPreviewModal({{ file.id }}, '{{ file.mime_type or '' }}', '{{ file.original_filename | e }}', event)" class="action-btn" title="Quick preview" aria-label="Preview {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
+              <button onclick="openPreviewModal({{ file.id }}, '{{ file.mime_type or '' }}', '{{ file.original_filename | e }}', event)" class="action-btn" title="{{ _('files.action_preview') }}" aria-label="{{ _('files.action_preview') }} {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
                 <i class="fas fa-eye" aria-hidden="true"></i>
               </button>
-              <button onclick="viewFileDetail({{ file.id }}, event)" class="action-btn" title="View details" aria-label="View details for {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
+              <button onclick="viewFileDetail({{ file.id }}, event)" class="action-btn" title="{{ _('files.action_details') }}" aria-label="{{ _('files.action_details') }} {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
                 <i class="fas fa-info-circle" aria-hidden="true"></i>
               </button>
-              <button onclick="showDeleteModal({{ file.id }}, event)" class="action-btn delete" title="Delete file" aria-label="Delete {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
+              <button onclick="showDeleteModal({{ file.id }}, event)" class="action-btn delete" title="{{ _('files.action_delete') }}" aria-label="{{ _('files.action_delete') }} {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
                 <i class="fas fa-trash" aria-hidden="true"></i>
               </button>
             </div>
@@ -752,25 +753,25 @@
       tabindex="0"
       onclick="viewFileDetail({{ file.id }}, event)"
       onkeydown="if(event.key==='Enter'||event.key===' '){viewFileDetail({{ file.id }}, event);}"
-      aria-label="View details for {{ file.original_filename }}"
+      aria-label="{{ _('files.action_details') }} {{ file.original_filename }}"
     >
       <div class="flex items-start justify-between gap-2">
         <div class="flex-1 min-w-0">
           <p class="font-semibold text-gray-800 truncate">{{ file.original_filename }}</p>
           <p class="text-xs text-gray-500 mt-1">ID: {{ file.id }} &middot; {{ (file.file_size / 1024) | round(2) }} KB</p>
           <p class="text-xs text-gray-500 mt-0.5">{{ file.mime_type }}</p>
-          <p class="text-xs text-gray-400 mt-0.5">{{ file.created_at.strftime('%Y-%m-%d %H:%M') if file.created_at else 'N/A' }}</p>
+          <p class="text-xs text-gray-400 mt-0.5">{{ file.created_at.strftime('%Y-%m-%d %H:%M') if file.created_at else _('common.not_available') }}</p>
         </div>
         <div class="flex flex-col items-end gap-2 flex-shrink-0">
-          <span class="status-badge status-{{ file.processing_status }}">{{ file.processing_status | title }}</span>
-          <div class="flex gap-1" role="group" aria-label="File actions" onclick="event.stopPropagation();" onkeydown="event.stopPropagation();">
-            <button onclick="openPreviewModal({{ file.id }}, '{{ file.mime_type or '' }}', '{{ file.original_filename | e }}', event)" class="action-btn" title="Quick preview" aria-label="Preview {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
+          <span class="status-badge status-{{ file.processing_status }}">{% if file.processing_status == 'pending' %}{{ _("common.pending") }}{% elif file.processing_status == 'processing' %}{{ _("common.processing") }}{% elif file.processing_status == 'completed' %}{{ _("common.completed") }}{% elif file.processing_status == 'failed' %}{{ _("common.failed") }}{% elif file.processing_status == 'duplicate' %}{{ _("files.status_duplicate") }}{% else %}{{ file.processing_status | title }}{% endif %}</span>
+          <div class="flex gap-1" role="group" aria-label="{{ _('files.file_actions_aria') }}" onclick="event.stopPropagation();" onkeydown="event.stopPropagation();">
+            <button onclick="openPreviewModal({{ file.id }}, '{{ file.mime_type or '' }}', '{{ file.original_filename | e }}', event)" class="action-btn" title="{{ _('files.action_preview') }}" aria-label="{{ _('files.action_preview') }} {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
               <i class="fas fa-eye" aria-hidden="true"></i>
             </button>
-            <button onclick="viewFileDetail({{ file.id }}, event)" class="action-btn" title="View details" aria-label="View details for {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
+            <button onclick="viewFileDetail({{ file.id }}, event)" class="action-btn" title="{{ _('files.action_details') }}" aria-label="{{ _('files.action_details') }} {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
               <i class="fas fa-info-circle" aria-hidden="true"></i>
             </button>
-            <button onclick="showDeleteModal({{ file.id }}, event)" class="action-btn delete" title="Delete file" aria-label="Delete {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
+            <button onclick="showDeleteModal({{ file.id }}, event)" class="action-btn delete" title="{{ _('files.action_delete') }}" aria-label="{{ _('files.action_delete') }} {{ file.original_filename }}" style="min-height:44px;min-width:44px;">
               <i class="fas fa-trash" aria-hidden="true"></i>
             </button>
           </div>
@@ -841,6 +842,54 @@
   </div>
 
   <script>
+    // ── Translations for JavaScript ──
+    const __i18n = {
+      previewFallback: {{ _("files.js_preview_fallback") | tojson }},
+      fullView: {{ _("files.js_full_view") | tojson }},
+      download: {{ _("files.js_download") | tojson }},
+      loading: {{ _("files.js_loading") | tojson }},
+      failedLoadPdf: {{ _("files.js_failed_load_pdf") | tojson }},
+      pdfPageInfo: {{ _("files.js_pdf_page_info") | tojson }},
+      failedLoadFile: {{ _("files.js_failed_load_file") | tojson }},
+      openFullViewAria: {{ _("files.js_open_full_view_aria") | tojson }},
+      downloadFileAria: {{ _("files.js_download_file_aria") | tojson }},
+      failedDeleteFile: {{ _("files.js_failed_delete_file") | tojson }},
+      errorDeletingFile: {{ _("files.js_error_deleting_file") | tojson }},
+      noSavedSearches: {{ _("files.js_no_saved_searches") | tojson }},
+      loadSavedSearchesError: {{ _("files.js_load_saved_searches_error") | tojson }},
+      noFiltersToSave: {{ _("files.js_no_filters_to_save") | tojson }},
+      enterSearchName: {{ _("files.js_enter_search_name") | tojson }},
+      deleteSavedSearchConfirm: {{ _("files.js_delete_saved_search_confirm") | tojson }},
+      deleteSavedSearchAria: {{ _("files.js_delete_saved_search_aria") | tojson }},
+      selectFilesDelete: {{ _("files.js_select_files_delete") | tojson }},
+      confirmDeleteFiles: {{ _("files.js_confirm_delete_files") | tojson }},
+      failedDeleteFiles: {{ _("files.js_failed_delete_files") | tojson }},
+      errorDeletingFiles: {{ _("files.js_error_deleting_files") | tojson }},
+      selectFilesReprocess: {{ _("files.js_select_files_reprocess") | tojson }},
+      confirmReprocessFiles: {{ _("files.js_confirm_reprocess_files") | tojson }},
+      failedReprocessFiles: {{ _("files.js_failed_reprocess_files") | tojson }},
+      errorReprocessingFiles: {{ _("files.js_error_reprocessing_files") | tojson }},
+      selectFilesCloudOcr: {{ _("files.js_select_files_cloud_ocr") | tojson }},
+      confirmCloudOcr: {{ _("files.js_confirm_cloud_ocr") | tojson }},
+      failedQueueCloudOcr: {{ _("files.js_failed_queue_cloud_ocr") | tojson }},
+      errorQueuingCloudOcr: {{ _("files.js_error_queuing_cloud_ocr") | tojson }},
+      selectFilesDownload: {{ _("files.js_select_files_download") | tojson }},
+      failedCreateZip: {{ _("files.js_failed_create_zip") | tojson }},
+      errorDownloadingFiles: {{ _("files.js_error_downloading_files") | tojson }},
+      searching: {{ _("files.js_searching") | tojson }},
+      searchUnavailable: {{ _("files.js_search_unavailable") | tojson }},
+      searchResultsCount: {{ _("files.js_search_results_count") | tojson }},
+      noResults: {{ _("files.js_no_results") | tojson }},
+      untitled: {{ _("files.js_untitled") | tojson }},
+      viewFile: {{ _("files.js_view_file") | tojson }},
+      prevPage: {{ _("files.js_prev_page") | tojson }},
+      pageInfo: {{ _("files.js_page_info") | tojson }},
+      nextPage: {{ _("files.js_next_page") | tojson }},
+      zoomIn: {{ _("files.js_zoom_in") | tojson }},
+      zoomOut: {{ _("files.js_zoom_out") | tojson }},
+      resetZoom: {{ _("files.js_reset_zoom") | tojson }},
+    };
+
     // Modal functionality
     const deleteModal = document.getElementById('deleteModal');
     const cancelDelete = document.getElementById('cancelDelete');
@@ -868,7 +917,7 @@
       const title = document.getElementById('previewTitle');
       const body = document.getElementById('previewBody');
       const footer = document.getElementById('previewFooter');
-      title.textContent = filename || 'Preview';
+      title.textContent = filename || __i18n.previewFallback;
       body.innerHTML = '<div style="display:flex;align-items:center;justify-content:center;height:300px;color:#9ca3af;"><i class="fas fa-spinner fa-spin" style="font-size:2rem;"></i></div>';
       footer.innerHTML = '';
       _pmPdf = { doc: null, page: 1, total: 0 };
@@ -877,8 +926,8 @@
       document.body.style.overflow = 'hidden';
 
       footer.innerHTML =
-        `<a href="/files/${fileId}" aria-label="Open full view"><i class="fas fa-expand" aria-hidden="true"></i> Full view</a>` +
-        `<a href="/api/files/${fileId}/download?version=processed" aria-label="Download file"><i class="fas fa-download" aria-hidden="true"></i> Download</a>`;
+        `<a href="/files/${fileId}" aria-label="${__i18n.openFullViewAria}"><i class="fas fa-expand" aria-hidden="true"></i> ${__i18n.fullView}</a>` +
+        `<a href="/api/files/${fileId}/download?version=processed" aria-label="${__i18n.downloadFileAria}"><i class="fas fa-download" aria-hidden="true"></i> ${__i18n.download}</a>`;
 
       // Try "processed" first; fall back to "original" on 404
       _pmLoadPreview(body, fileId, mime, filename, 'processed');
@@ -911,7 +960,7 @@
       body.innerHTML =
         '<div class="pm-pdf-controls">' +
           '<button onclick="_pmPdfPage(-1)" id="pm-prev" aria-label="Previous page"><i class="fas fa-chevron-left" aria-hidden="true"></i></button>' +
-          '<span id="pm-page-info" style="font-size:0.8rem;min-width:100px;text-align:center;">Loading…</span>' +
+          '<span id="pm-page-info" style="font-size:0.8rem;min-width:100px;text-align:center;">' + __i18n.loading + '</span>' +
           '<button onclick="_pmPdfPage(1)" id="pm-next" aria-label="Next page"><i class="fas fa-chevron-right" aria-hidden="true"></i></button>' +
         '</div>' +
         '<div class="pm-canvas-wrap" id="pm-canvas-wrap"><div style="text-align:center;padding:3rem;color:#94a3b8;"><i class="fas fa-spinner fa-spin" style="font-size:2rem;"></i></div></div>';
@@ -923,7 +972,7 @@
         _pmPdfRender();
       }).catch(function() {
         if (onError) { onError(); return; }
-        document.getElementById('pm-canvas-wrap').innerHTML = '<div style="text-align:center;padding:2rem;color:#f87171;"><i class="fas fa-exclamation-triangle" style="font-size:2rem;margin-bottom:0.5rem;"></i><p>Failed to load PDF</p></div>';
+        document.getElementById('pm-canvas-wrap').innerHTML = '<div style="text-align:center;padding:2rem;color:#f87171;"><i class="fas fa-exclamation-triangle" style="font-size:2rem;margin-bottom:0.5rem;"></i><p>' + __i18n.failedLoadPdf + '</p></div>';
       });
     }
 
@@ -953,7 +1002,7 @@
 
     function _pmPdfUpdateInfo() {
       var info = document.getElementById('pm-page-info');
-      if (info) info.textContent = 'Page ' + _pmPdf.page + ' of ' + _pmPdf.total;
+      if (info) info.textContent = __i18n.pdfPageInfo.replace('{page}', _pmPdf.page).replace('{total}', _pmPdf.total);
       var prev = document.getElementById('pm-prev');
       var next = document.getElementById('pm-next');
       if (prev) prev.disabled = _pmPdf.page <= 1;
@@ -964,12 +1013,12 @@
     function _pmRenderImage(body, url, alt) {
       body.innerHTML =
         '<div class="pm-img-controls">' +
-          '<button onclick="_pmImgZoom(1.25)" title="Zoom in" aria-label="Zoom in"><i class="fas fa-search-plus" aria-hidden="true"></i></button>' +
-          '<button onclick="_pmImgZoom(0.8)" title="Zoom out" aria-label="Zoom out"><i class="fas fa-search-minus" aria-hidden="true"></i></button>' +
-          '<button onclick="_pmImgReset()" title="Reset" aria-label="Reset zoom"><i class="fas fa-expand" aria-hidden="true"></i></button>' +
+          '<button onclick="_pmImgZoom(1.25)" title="' + __i18n.zoomIn + '" aria-label="' + __i18n.zoomIn + '"><i class="fas fa-search-plus" aria-hidden="true"></i></button>' +
+          '<button onclick="_pmImgZoom(0.8)" title="' + __i18n.zoomOut + '" aria-label="' + __i18n.zoomOut + '"><i class="fas fa-search-minus" aria-hidden="true"></i></button>' +
+          '<button onclick="_pmImgReset()" title="' + __i18n.resetZoom + '" aria-label="' + __i18n.resetZoom + '"><i class="fas fa-expand" aria-hidden="true"></i></button>' +
           '<span id="pm-zoom-level" style="font-size:0.8rem;color:#6b7280;">100%</span>' +
         '</div>' +
-        '<div class="pm-img-wrap" id="pm-img-wrap"><img id="pm-preview-img" src="' + url + '" alt="' + (alt || 'Preview') + '" draggable="false" style="max-width:100%;height:auto;"></div>';
+        '<div class="pm-img-wrap" id="pm-img-wrap"><img id="pm-preview-img" src="' + url + '" alt="' + (alt || __i18n.previewFallback) + '" draggable="false" style="max-width:100%;height:auto;"></div>';
       // Drag-pan
       var wrap = document.getElementById('pm-img-wrap');
       if (wrap) {
@@ -1000,7 +1049,7 @@
 
     // Text rendering inside preview modal
     function _pmRenderText(body, url, onError) {
-      body.innerHTML = '<div class="pm-text-content" id="pm-text-content"><div style="text-align:center;padding:2rem;color:#94a3b8;"><i class="fas fa-spinner fa-spin"></i> Loading…</div></div>';
+      body.innerHTML = '<div class="pm-text-content" id="pm-text-content"><div style="text-align:center;padding:2rem;color:#94a3b8;"><i class="fas fa-spinner fa-spin"></i> ' + __i18n.loading + '</div></div>';
       fetch(url)
         .then(function(r) { if (!r.ok) throw new Error('HTTP ' + r.status); return r.text(); })
         .then(function(text) {
@@ -1021,7 +1070,7 @@
         .catch(function() {
           if (onError) { onError(); return; }
           var c = document.getElementById('pm-text-content');
-          if (c) c.innerHTML = '<div style="color:#f87171;padding:1rem;">Failed to load file</div>';
+          if (c) c.innerHTML = '<div style="color:#f87171;padding:1rem;">' + __i18n.failedLoadFile + '</div>';
         });
     }
 
@@ -1065,7 +1114,7 @@
           const contentType = response.headers.get('content-type');
           if (contentType && contentType.includes('application/json')) {
             return response.json().then(err => {
-              throw new Error(err.detail || 'Failed to delete file');
+              throw new Error(err.detail || __i18n.failedDeleteFile);
             });
           } else {
             // Non-JSON response (likely HTML error page)
@@ -1084,7 +1133,7 @@
       })
       .catch(error => {
         console.error('Error:', error);
-        alert(`Error deleting file: ${error.message}`);
+        alert(__i18n.errorDeletingFile.replace('{error}', error.message));
       });
     }
 
@@ -1124,14 +1173,14 @@
           const container = document.getElementById('saved-searches-list');
           if (!container) return;
           if (!searches || searches.length === 0) {
-            container.innerHTML = '<span style="color: var(--text-muted); font-size: 0.85rem;">No saved searches yet</span>';
+            container.innerHTML = '<span style="color: var(--text-muted); font-size: 0.85rem;">' + __i18n.noSavedSearches + '</span>';
             return;
           }
           container.innerHTML = searches.map(s => {
             const params = new URLSearchParams(s.filters);
             return `<span class="saved-search-tag" style="display: inline-flex; align-items: center; gap: 0.25rem; background: var(--bg-tertiary, #e5e7eb); padding: 0.2rem 0.5rem; border-radius: 0.25rem; font-size: 0.8rem;">
               <a href="/files?${params.toString()}" style="text-decoration: none; color: inherit;">${s.name}</a>
-              <button type="button" onclick="deleteSavedSearch(${s.id})" style="border: none; background: none; cursor: pointer; color: var(--text-muted); padding: 0; line-height: 1;" aria-label="Delete saved search ${s.name}">
+              <button type="button" onclick="deleteSavedSearch(${s.id})" style="border: none; background: none; cursor: pointer; color: var(--text-muted); padding: 0; line-height: 1;" aria-label="${__i18n.deleteSavedSearchAria.replace('{name}', s.name)}">
                 <i class="fas fa-times" aria-hidden="true"></i>
               </button>
             </span>`;
@@ -1139,7 +1188,7 @@
         })
         .catch(() => {
           const container = document.getElementById('saved-searches-list');
-          if (container) container.innerHTML = '<span style="color: var(--text-muted); font-size: 0.85rem;">Could not load saved searches</span>';
+          if (container) container.innerHTML = '<span style="color: var(--text-muted); font-size: 0.85rem;">' + __i18n.loadSavedSearchesError + '</span>';
         });
     }
 
@@ -1152,10 +1201,10 @@
         if (val) filters[key] = val;
       });
       if (Object.keys(filters).length === 0) {
-        alert('No filters to save. Please apply at least one filter (search, date, status, tags, etc.) before saving.');
+        alert(__i18n.noFiltersToSave);
         return;
       }
-      const name = prompt('Enter a name for this saved search:');
+      const name = prompt(__i18n.enterSearchName);
       if (!name || !name.trim()) return;
       fetch('/api/saved-searches', {
         method: 'POST',
@@ -1171,7 +1220,7 @@
     }
 
     function deleteSavedSearch(id) {
-      if (!confirm('Delete this saved search?')) return;
+      if (!confirm(__i18n.deleteSavedSearchConfirm)) return;
       fetch(`/api/saved-searches/${id}`, { method: 'DELETE' })
         .then(response => {
           if (!response.ok) throw new Error('Failed to delete');
@@ -1226,11 +1275,11 @@
     function bulkDelete() {
       const fileIds = getSelectedFileIds();
       if (fileIds.length === 0) {
-        alert('Please select files to delete');
+        alert(__i18n.selectFilesDelete);
         return;
       }
 
-      if (!confirm(`Are you sure you want to delete ${fileIds.length} file(s)?`)) {
+      if (!confirm(__i18n.confirmDeleteFiles.replace('{count}', fileIds.length))) {
         return;
       }
 
@@ -1244,7 +1293,7 @@
       .then(response => {
         if (!response.ok) {
           return response.json().then(err => {
-            throw new Error(err.detail || 'Failed to delete files');
+            throw new Error(err.detail || __i18n.failedDeleteFiles);
           });
         }
         return response.json();
@@ -1255,18 +1304,18 @@
       })
       .catch(error => {
         console.error('Error:', error);
-        alert(`Error deleting files: ${error.message}`);
+        alert(__i18n.errorDeletingFiles.replace('{error}', error.message));
       });
     }
 
     function bulkReprocess() {
       const fileIds = getSelectedFileIds();
       if (fileIds.length === 0) {
-        alert('Please select files to reprocess');
+        alert(__i18n.selectFilesReprocess);
         return;
       }
 
-      if (!confirm(`Are you sure you want to reprocess ${fileIds.length} file(s)?`)) {
+      if (!confirm(__i18n.confirmReprocessFiles.replace('{count}', fileIds.length))) {
         return;
       }
 
@@ -1280,7 +1329,7 @@
       .then(response => {
         if (!response.ok) {
           return response.json().then(err => {
-            throw new Error(err.detail || 'Failed to reprocess files');
+            throw new Error(err.detail || __i18n.failedReprocessFiles);
           });
         }
         return response.json();
@@ -1297,18 +1346,18 @@
       })
       .catch(error => {
         console.error('Error:', error);
-        alert(`Error reprocessing files: ${error.message}`);
+        alert(__i18n.errorReprocessingFiles.replace('{error}', error.message));
       });
     }
 
     function bulkReprocessCloudOcr() {
       const fileIds = getSelectedFileIds();
       if (fileIds.length === 0) {
-        alert('Please select files to re-run Cloud OCR on');
+        alert(__i18n.selectFilesCloudOcr);
         return;
       }
 
-      if (!confirm(`Are you sure you want to re-run Cloud OCR on ${fileIds.length} file(s)?`)) {
+      if (!confirm(__i18n.confirmCloudOcr.replace('{count}', fileIds.length))) {
         return;
       }
 
@@ -1322,7 +1371,7 @@
       .then(response => {
         if (!response.ok) {
           return response.json().then(err => {
-            throw new Error(err.detail || 'Failed to queue Cloud OCR');
+            throw new Error(err.detail || __i18n.failedQueueCloudOcr);
           });
         }
         return response.json();
@@ -1339,14 +1388,14 @@
       })
       .catch(error => {
         console.error('Error:', error);
-        alert(`Error queuing Cloud OCR: ${error.message}`);
+        alert(__i18n.errorQueuingCloudOcr.replace('{error}', error.message));
       });
     }
 
     function bulkDownload() {
       const fileIds = getSelectedFileIds();
       if (fileIds.length === 0) {
-        alert('Please select files to download');
+        alert(__i18n.selectFilesDownload);
         return;
       }
 
@@ -1360,7 +1409,7 @@
       .then(response => {
         if (!response.ok) {
           return response.json().then(err => {
-            throw new Error(err.detail || 'Failed to create ZIP download');
+            throw new Error(err.detail || __i18n.failedCreateZip);
           });
         }
         return response.blob();
@@ -1377,7 +1426,7 @@
       })
       .catch(error => {
         console.error('Error:', error);
-        alert(`Error downloading files: ${error.message}`);
+        alert(__i18n.errorDownloadingFiles.replace('{error}', error.message));
       });
     }
 
@@ -1471,7 +1520,7 @@
       const summary = document.getElementById('search-results-summary');
       const pagination = document.getElementById('search-results-pagination');
 
-      list.innerHTML = '<div style="padding: 1rem; color: #6b7280; font-size: 0.875rem;"><i class="fas fa-spinner fa-spin"></i> Searching…</div>';
+      list.innerHTML = '<div style="padding: 1rem; color: #6b7280; font-size: 0.875rem;"><i class="fas fa-spinner fa-spin"></i> ' + __i18n.searching + '</div>';
       summary.textContent = '';
       pagination.innerHTML = '';
       panel.style.display = 'block';
@@ -1484,7 +1533,7 @@
         })
         .then(data => renderSearchResults(data, q))
         .catch(err => {
-          list.innerHTML = `<div style="padding: 1rem; color: #dc2626; font-size: 0.875rem;"><i class="fas fa-exclamation-triangle"></i> Search unavailable: ${err.message}</div>`;
+          list.innerHTML = '<div style="padding: 1rem; color: #dc2626; font-size: 0.875rem;"><i class="fas fa-exclamation-triangle"></i> ' + __i18n.searchUnavailable.replace('{error}', err.message) + '</div>';
           summary.textContent = '';
         });
     }
@@ -1496,17 +1545,17 @@
       const pagination = document.getElementById('search-results-pagination');
 
       const { results, total, page, pages } = data;
-      summary.textContent = `${total} result${total !== 1 ? 's' : ''} for "${q}"`;
+      summary.textContent = __i18n.searchResultsCount.replace('{total}', total).replace('{query}', q);
 
       if (!results || results.length === 0) {
-        list.innerHTML = '<div style="padding: 1rem; color: #6b7280; font-size: 0.875rem;">No results found.</div>';
+        list.innerHTML = '<div style="padding: 1rem; color: #6b7280; font-size: 0.875rem;">' + __i18n.noResults + '</div>';
         pagination.innerHTML = '';
         return;
       }
 
       list.innerHTML = results.map(hit => {
         const fmt = hit._formatted || {};
-        const title = fmt.document_title || hit.document_title || hit.original_filename || '(untitled)';
+        const title = fmt.document_title || hit.document_title || hit.original_filename || __i18n.untitled;
         const filename = fmt.original_filename || hit.original_filename || '';
         const snippet = fmt.ocr_text || '';
         const tags = Array.isArray(hit.tags) ? hit.tags.join(', ') : (hit.tags || '');
@@ -1524,7 +1573,7 @@
             ${snippet ? `<div style="margin-top: 0.4rem; font-size: 0.8rem; color: #374151; white-space: pre-wrap; word-break: break-word;">…${snippet}…</div>` : ''}
           </div>
           <div style="flex-shrink: 0;">
-            <a href="/files/${hit.file_id}" style="padding: 0.25rem 0.6rem; background: #f3f4f6; color: #374151; border-radius: 0.25rem; font-size: 0.8rem; text-decoration: none; white-space: nowrap;" title="View file">
+            <a href="/files/${hit.file_id}" style="padding: 0.25rem 0.6rem; background: #f3f4f6; color: #374151; border-radius: 0.25rem; font-size: 0.8rem; text-decoration: none; white-space: nowrap;" title="${__i18n.viewFile}">
               <i class="fas fa-external-link-alt"></i>
             </a>
           </div>
@@ -1535,11 +1584,11 @@
       if (pages > 1) {
         const btns = [];
         if (page > 1) {
-          btns.push(`<button onclick="runFullTextSearch(${page - 1})" style="padding: 0.25rem 0.6rem; border: 1px solid #d1d5db; border-radius: 0.25rem; font-size: 0.8rem; cursor: pointer; background: white;">« Prev</button>`);
+          btns.push(`<button onclick="runFullTextSearch(${page - 1})" style="padding: 0.25rem 0.6rem; border: 1px solid #d1d5db; border-radius: 0.25rem; font-size: 0.8rem; cursor: pointer; background: white;">${__i18n.prevPage}</button>`);
         }
-        btns.push(`<span style="padding: 0.25rem 0.6rem; font-size: 0.8rem; color: #6b7280;">Page ${page} / ${pages}</span>`);
+        btns.push(`<span style="padding: 0.25rem 0.6rem; font-size: 0.8rem; color: #6b7280;">${__i18n.pageInfo.replace('{page}', page).replace('{pages}', pages)}</span>`);
         if (page < pages) {
-          btns.push(`<button onclick="runFullTextSearch(${page + 1})" style="padding: 0.25rem 0.6rem; border: 1px solid #d1d5db; border-radius: 0.25rem; font-size: 0.8rem; cursor: pointer; background: white;">Next »</button>`);
+          btns.push(`<button onclick="runFullTextSearch(${page + 1})" style="padding: 0.25rem 0.6rem; border: 1px solid #d1d5db; border-radius: 0.25rem; font-size: 0.8rem; cursor: pointer; background: white;">${__i18n.nextPage}</button>`);
         }
         pagination.innerHTML = btns.join('');
       } else {