chore(release): update build metadata files [skip ci]

Automatically generated by python-semantic-release

.env.demo

@@ -3,21 +3,10 @@ WORKDIR=/workdir
 DATABASE_URL=sqlite:///./app/database.db
 REDIS_URL=redis://redis:6379/0
 EXTERNAL_HOSTNAME=docuelevate.example.com
-# PUBLIC_BASE_URL=https://docuelevate.example.com  # Full URL with scheme; required when X-Forwarded-Proto is not forwarded by your proxy
 GOTENBERG_URL=http://gotenberg:3000
 ALLOW_FILE_DELETE=true  # Allow deletion of file records
 COMPLIANCE_ENABLED=true  # Enable compliance templates dashboard (GDPR, HIPAA, SOC 2)
 
-# **Database Connection Pool** (PostgreSQL / MySQL only; ignored for SQLite)
-# DB_POOL_SIZE=10         # Persistent connections per worker (default: 10)
-# DB_MAX_OVERFLOW=20      # Extra connections under burst (default: 20)
-# DB_POOL_TIMEOUT=30      # Seconds to wait for a pool connection (default: 30)
-# DB_POOL_RECYCLE=1800    # Recycle connections after N seconds (default: 1800)
-
-# **Per-User Upload Rate Limiting** (health-aware, Redis-backed)
-# UPLOAD_RATE_LIMIT_PER_USER=20   # Max uploads per user per window (default: 20)
-# UPLOAD_RATE_LIMIT_WINDOW=60     # Sliding window in seconds (default: 60)
-
 # **System Reset / Factory Reset**
 # FACTORY_RESET_ON_STARTUP=false  # Wipe all user data on every startup (demo/testing only)
 # ENABLE_FACTORY_RESET=false      # Show the System Reset page in admin UI
@@ -636,26 +625,9 @@ EMBEDDING_MAX_TOKENS=8000
 # Profiling is only active when SENTRY_TRACES_SAMPLE_RATE > 0. Default: 0.0 (disabled).
 # SENTRY_PROFILES_SAMPLE_RATE=0.0
 #
-# Attach PII (IP addresses, user agents) to Sentry events.
+# Attach PII (IP addresses, user agents) to Sentry events.
-# Disable (default) to stay GDPR/CCPA compliant.
+# Disable (default) to stay GDPR/CCPA compliant.
-# SENTRY_SEND_DEFAULT_PII=false
+# SENTRY_SEND_DEFAULT_PII=false
-#
-# --- Browser (JavaScript) SDK ---
-# The same DSN is reused for the Sentry Browser SDK which is injected into
-# every rendered page.  The DSN is a *public* key and is intentionally
-# embedded in client-side code.
-#
-# Fraction of browser navigations captured for client-side performance tracing.
-# 0.0 (default) disables browser tracing; 1.0 captures every navigation.
-# SENTRY_JS_TRACES_SAMPLE_RATE=0.0
-#
-# Fraction of browser sessions recorded by Sentry Session Replay.
-# 0.0 (default) disables session recording; 1.0 records every session.
-# SENTRY_JS_REPLAY_SESSION_SAMPLE_RATE=0.0
-#
-# Fraction of error sessions recorded by Sentry Session Replay.
-# Defaults to 0.1 (10 %) so errors are captured with replay context.
-# SENTRY_JS_REPLAY_ON_ERROR_SAMPLE_RATE=0.1
 
 # **Mobile App – Push Notifications**
 # Push notifications are delivered via Expo's push notification service

.github/workflows/ci.yml

@@ -100,7 +100,7 @@ jobs:
           python-version: "3.11"
           cache: 'pip'
       - run: pip install pip-audit>=2.7.0
-      - run: pip-audit -r requirements.txt --desc on
+      - run: pip-audit -r requirements.txt --desc on --ignore-vuln CVE-2026-4539
 
   run-tests:
     name: Execute All Tests (Quick + Integration)

.gitignore

@@ -200,3 +200,5 @@ cython_debug/
 # Build metadata files - generated at build time
 GIT_SHA
 RUNTIME_INFO
+node_modules
+frontend/node_modules

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "vendor/embed-pdf-viewer"]
-	path = vendor/embed-pdf-viewer
-	url = https://github.com/embedpdf/embed-pdf-viewer.git

.jules/sentinel.md

@@ -1,8 +1,4 @@
-## 2024-05-24 - SSRF in WebDAV connection test
+## 2026-06-01 - [Fix XSS in status_dashboard.html]
-**Vulnerability:** The `_test_webdav_connection` function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., `127.0.0.1`).
+**Vulnerability:** A Cross-Site Scripting (XSS) vulnerability existed in `frontend/templates/status_dashboard.html` where untrusted configuration settings (`value`), external service messages (`data.message`), and token expirations (`data.token_info.expires_in_human`) were injected directly into the DOM via `.innerHTML` without sanitization.
-**Learning:** DNS resolution is required for robust SSRF protection when validating URLs provided by users.
+**Learning:** Even internal or admin-focused dashboards can be vulnerable if they display external or user-configurable data without escaping. Constructing HTML strings dynamically from unvalidated sources is a common vector for DOM-based XSS.
-**Prevention:** Use a centralized `is_private_ip` function (now in `app/utils/network.py`) that resolves the hostname to its IPs and checks if any are private.
+**Prevention:** Always use a sanitization function like `escapeHtml` to escape dangerous characters (`<`, `>`, `&`, `"`, `'`) before assigning dynamic content to `.innerHTML`, or prefer `.textContent` when only plaintext is intended.
-## 2026-03-22 - B310: urllib.request.urlopen replaced with httpx
-**Vulnerability:** The `_test_webdav_connection` function used `urllib.request.urlopen`, which natively supports dangerous schemes like `file://` or `ftp://` and follows redirects by default, potentially allowing SSRF bypasses or Local File Inclusion.
-**Learning:** `urllib.request` should be avoided for user-supplied URLs. Even when URL schemes are manually validated, `urllib`'s default redirect following behavior can bypass SSRF protections (e.g. redirecting to `127.0.0.1`).
-**Prevention:** Use a modern, safer HTTP client like `httpx` with `follow_redirects=False` when testing user-provided URLs.

BUILD_DATE

@@ -1 +1 @@
-2026-03-22T14:46:09Z
+2026-06-01T03:41:15Z

CHANGELOG.md

@@ -10,6 +10,704 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- version list -->
 
+## v0.173.4 (2026-06-01)
+
+### Bug Fixes
+
+- Address status dashboard xss review nits
+  ([`425805a`](https://github.com/christianlouis/DocuElevate/commit/425805ab23882944aee0cb02b5e497bc536549c0))
+
+### Build System
+
+- **deps**: Update redis requirement from >=4.5.0 to >=8.0.0
+  ([#904](https://github.com/christianlouis/DocuElevate/pull/904),
+  [`20bde93`](https://github.com/christianlouis/DocuElevate/commit/20bde939eb96ec8e6700b206e046388b6b891e38))
+
+- **deps-dev**: Update pytest-asyncio requirement
+  ([#903](https://github.com/christianlouis/DocuElevate/pull/903),
+  [`4a12559`](https://github.com/christianlouis/DocuElevate/commit/4a125590b9b6cb2f07bae187a9bff708dd92a5c3))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`98252e0`](https://github.com/christianlouis/DocuElevate/commit/98252e06c30bba78520a8460d55f508dbf2bdd47))
+
+- **changelog**: Update changelog [skip ci]
+  ([`8be7965`](https://github.com/christianlouis/DocuElevate/commit/8be7965ed1892978092c3f5e02e6252918c237fd))
+
+
+## Unreleased
+
+### Build System
+
+- **deps**: Update redis requirement from >=4.5.0 to >=8.0.0
+  ([#904](https://github.com/christianlouis/DocuElevate/pull/904),
+  [`20bde93`](https://github.com/christianlouis/DocuElevate/commit/20bde939eb96ec8e6700b206e046388b6b891e38))
+
+- **deps-dev**: Update pytest-asyncio requirement
+  ([#903](https://github.com/christianlouis/DocuElevate/pull/903),
+  [`4a12559`](https://github.com/christianlouis/DocuElevate/commit/4a125590b9b6cb2f07bae187a9bff708dd92a5c3))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`8be7965`](https://github.com/christianlouis/DocuElevate/commit/8be7965ed1892978092c3f5e02e6252918c237fd))
+
+
+## Unreleased
+
+### Build System
+
+- **deps-dev**: Update pytest-asyncio requirement
+  ([#903](https://github.com/christianlouis/DocuElevate/pull/903),
+  [`4a12559`](https://github.com/christianlouis/DocuElevate/commit/4a125590b9b6cb2f07bae187a9bff708dd92a5c3))
+
+
+## v0.173.3 (2026-05-31)
+
+### Bug Fixes
+
+- Preserve falsy values in escapeHtml
+  ([`37c27c0`](https://github.com/christianlouis/DocuElevate/commit/37c27c02139ae4a462e1705bda9360b23eb835b3))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`cc56127`](https://github.com/christianlouis/DocuElevate/commit/cc561277c9d7d0177b4ac63921637659abb66fba))
+
+- **changelog**: Update changelog [skip ci]
+  ([`948d118`](https://github.com/christianlouis/DocuElevate/commit/948d118926be042cc3c2a68f58241cc2fcfa23ef))
+
+- **changelog**: Update changelog [skip ci]
+  ([`65bd6d7`](https://github.com/christianlouis/DocuElevate/commit/65bd6d71d00ff7078a05ce12b00f228405e2ec1e))
+
+
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`948d118`](https://github.com/christianlouis/DocuElevate/commit/948d118926be042cc3c2a68f58241cc2fcfa23ef))
+
+- **changelog**: Update changelog [skip ci]
+  ([`65bd6d7`](https://github.com/christianlouis/DocuElevate/commit/65bd6d71d00ff7078a05ce12b00f228405e2ec1e))
+
+
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`65bd6d7`](https://github.com/christianlouis/DocuElevate/commit/65bd6d71d00ff7078a05ce12b00f228405e2ec1e))
+
+
+## Unreleased
+
+
+## v0.173.2 (2026-05-23)
+
+### Bug Fixes
+
+- Resolve dependabot npm alerts
+  ([`6fc00b8`](https://github.com/christianlouis/DocuElevate/commit/6fc00b8de10b50b4b2f92f6fadbcf7ebbee7136f))
+
+### Documentation
+
+- Extend product roadmap and milestones
+  ([`e46f9b9`](https://github.com/christianlouis/DocuElevate/commit/e46f9b9a21e5838f883eca4370445e0f1b57e6c9))
+
+- **changelog**: Update changelog [skip ci]
+  ([`427db10`](https://github.com/christianlouis/DocuElevate/commit/427db102d85fa676dcf01118fd3757fb300b979d))
+
+
+## Unreleased
+
+### Documentation
+
+- Extend product roadmap and milestones
+  ([`e46f9b9`](https://github.com/christianlouis/DocuElevate/commit/e46f9b9a21e5838f883eca4370445e0f1b57e6c9))
+
+
+## v0.173.1 (2026-05-22)
+
+### Bug Fixes
+
+- Register Evernote task settings
+  ([`1ca7f56`](https://github.com/christianlouis/DocuElevate/commit/1ca7f562ef284d2fcceca84b38661abe9038912a))
+
+
+## v0.173.0 (2026-05-22)
+
+### Code Style
+
+- Apply ruff auto-fix ([#862](https://github.com/christianlouis/DocuElevate/pull/862),
+  [`4b46c4b`](https://github.com/christianlouis/DocuElevate/commit/4b46c4baf890f3179ac060569ce2e076cf0551b0))
+
+### Features
+
+- **storage**: Add Evernote destination
+  ([#862](https://github.com/christianlouis/DocuElevate/pull/862),
+  [`4b46c4b`](https://github.com/christianlouis/DocuElevate/commit/4b46c4baf890f3179ac060569ce2e076cf0551b0))
+
+
+## v0.172.12 (2026-05-17)
+
+### Bug Fixes
+
+- Validate webhook targets before delivery
+  ([#846](https://github.com/christianlouis/DocuElevate/pull/846),
+  [`e2fa963`](https://github.com/christianlouis/DocuElevate/commit/e2fa96318f5bd45607baa0fe08a0bf14e1ca83d4))
+
+### Testing
+
+- Cover webhook SSRF validation ([#846](https://github.com/christianlouis/DocuElevate/pull/846),
+  [`e2fa963`](https://github.com/christianlouis/DocuElevate/commit/e2fa96318f5bd45607baa0fe08a0bf14e1ca83d4))
+
+
+## v0.172.11 (2026-05-17)
+
+### Bug Fixes
+
+- Escape search result template values
+  ([#853](https://github.com/christianlouis/DocuElevate/pull/853),
+  [`1a02187`](https://github.com/christianlouis/DocuElevate/commit/1a0218799b9a1eb4154e2f4fbb2572cb3922106a))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`048f28a`](https://github.com/christianlouis/DocuElevate/commit/048f28a6717fa7f5cf4b235f9142e625e80e5d59))
+
+
+## Unreleased
+
+
+## v0.172.10 (2026-05-17)
+
+### Bug Fixes
+
+- **url-upload**: Handle unsafe redirects as client errors
+  ([`871f788`](https://github.com/christianlouis/DocuElevate/commit/871f788f0bd782ba8ad3a7d70e5cd4ccd24f749b))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`58b14ae`](https://github.com/christianlouis/DocuElevate/commit/58b14ae769b85e25290126256de936743609af06))
+
+
+## Unreleased
+
+
+## v0.172.9 (2026-04-07)
+
+### Bug Fixes
+
+- **api**: Resolve merge conflicts, add type safety for endpoint_url in S3 connection test
+  ([`57db4c7`](https://github.com/christianlouis/DocuElevate/commit/57db4c7c82f4a8df2e7e5e5505e1d5c01768fc16))
+
+### Chores
+
+- **ci**: Ignore CVE-2026-4539 in pip-audit until pygments releases a fix
+  ([`6927e76`](https://github.com/christianlouis/DocuElevate/commit/6927e7643f9cbe1664f4a1a093511df5b079ed0a))
+
+### Code Style
+
+- Apply ruff auto-fix
+  ([`8295279`](https://github.com/christianlouis/DocuElevate/commit/8295279ec93570da4eb0445ede8084d1eb2aba99))
+
+- Sort imports in test_url_upload.py
+  ([`bdfa3ba`](https://github.com/christianlouis/DocuElevate/commit/bdfa3ba1e0a5702414e3b449fbde6a6d3149557a))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`c6e0b80`](https://github.com/christianlouis/DocuElevate/commit/c6e0b80becab81a75aea4ee78f5aaf8b6ac54854))
+
+- **changelog**: Update changelog [skip ci]
+  ([`9b9882c`](https://github.com/christianlouis/DocuElevate/commit/9b9882c4d62691d0ddd20444e3b77bfe6eecc8c3))
+
+- **changelog**: Update changelog [skip ci]
+  ([`69053bf`](https://github.com/christianlouis/DocuElevate/commit/69053bfb08d3e2f12a86878044667ac500888837))
+
+- **changelog**: Update changelog [skip ci]
+  ([`76f202f`](https://github.com/christianlouis/DocuElevate/commit/76f202f7f1b94e39a4e79cd984770310599405bf))
+
+### Testing
+
+- Add coverage for url_upload redirect SSRF bypass prevention hook
+  ([`152ee15`](https://github.com/christianlouis/DocuElevate/commit/152ee15b06ebf7beb6216423b4c8d93ec2243165))
+
+- Add tests for SSRF validation in integrations
+  ([`470f08d`](https://github.com/christianlouis/DocuElevate/commit/470f08d89322f2904b78a8b0f820973611486c26))
+
+
+## Unreleased
+
+### Chores
+
+- **ci**: Ignore CVE-2026-4539 in pip-audit until pygments releases a fix
+  ([`6927e76`](https://github.com/christianlouis/DocuElevate/commit/6927e7643f9cbe1664f4a1a093511df5b079ed0a))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`9b9882c`](https://github.com/christianlouis/DocuElevate/commit/9b9882c4d62691d0ddd20444e3b77bfe6eecc8c3))
+
+- **changelog**: Update changelog [skip ci]
+  ([`69053bf`](https://github.com/christianlouis/DocuElevate/commit/69053bfb08d3e2f12a86878044667ac500888837))
+
+- **changelog**: Update changelog [skip ci]
+  ([`76f202f`](https://github.com/christianlouis/DocuElevate/commit/76f202f7f1b94e39a4e79cd984770310599405bf))
+
+### Testing
+
+- Add tests for SSRF validation in integrations
+  ([`470f08d`](https://github.com/christianlouis/DocuElevate/commit/470f08d89322f2904b78a8b0f820973611486c26))
+
+
+## Unreleased
+
+### Chores
+
+- **ci**: Ignore CVE-2026-4539 in pip-audit until pygments releases a fix
+  ([`6927e76`](https://github.com/christianlouis/DocuElevate/commit/6927e7643f9cbe1664f4a1a093511df5b079ed0a))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`69053bf`](https://github.com/christianlouis/DocuElevate/commit/69053bfb08d3e2f12a86878044667ac500888837))
+
+- **changelog**: Update changelog [skip ci]
+  ([`76f202f`](https://github.com/christianlouis/DocuElevate/commit/76f202f7f1b94e39a4e79cd984770310599405bf))
+
+### Testing
+
+- Add tests for SSRF validation in integrations
+  ([`470f08d`](https://github.com/christianlouis/DocuElevate/commit/470f08d89322f2904b78a8b0f820973611486c26))
+
+
+## Unreleased
+
+### Chores
+
+- **ci**: Ignore CVE-2026-4539 in pip-audit until pygments releases a fix
+  ([`6927e76`](https://github.com/christianlouis/DocuElevate/commit/6927e7643f9cbe1664f4a1a093511df5b079ed0a))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`76f202f`](https://github.com/christianlouis/DocuElevate/commit/76f202f7f1b94e39a4e79cd984770310599405bf))
+
+
+## Unreleased
+
+### Chores
+
+- **ci**: Ignore CVE-2026-4539 in pip-audit until pygments releases a fix
+  ([`6927e76`](https://github.com/christianlouis/DocuElevate/commit/6927e7643f9cbe1664f4a1a093511df5b079ed0a))
+
+
+## v0.172.8 (2026-03-25)
+
+### Bug Fixes
+
+- **api**: Track env_file_written accurately in save_google_drive_settings
+  ([`4136033`](https://github.com/christianlouis/DocuElevate/commit/4136033bf0e580cbabe811084ab47ea0d6af8f9a))
+
+- **tests**: Add admin override fixture to TestSaveDropboxSettings
+  ([`cafc0e4`](https://github.com/christianlouis/DocuElevate/commit/cafc0e45230ffea096664c1947ac20753b63f8e9))
+
+- **tests**: Restore correct route URLs and fix auth/exception handling broken by d221753
+  ([`48331f6`](https://github.com/christianlouis/DocuElevate/commit/48331f6e91e6c0dae31ab3be31f9da1eccd0a549))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`c3124b0`](https://github.com/christianlouis/DocuElevate/commit/c3124b08bd48faa32e76d21d744c9902214048a7))
+
+
+## Unreleased
+
+
+## v0.172.7 (2026-03-24)
+
+### Bug Fixes
+
+- **api**: Remove duplicate Depends from AdminUser parameters in dropbox, onedrive, google_drive
+  ([`7f20c90`](https://github.com/christianlouis/DocuElevate/commit/7f20c903ef23e138518e715c7c7a0297d3e46ff8))
+
+- **dockerfile**: Add frontend-builder stage to compile Tailwind CSS
+  ([`3fd8b32`](https://github.com/christianlouis/DocuElevate/commit/3fd8b32724e3d390ff723e5b090a5603c3b1fc93))
+
+- **main**: Replace silent except-pass with exception logging to fix S110
+  ([`8fcc223`](https://github.com/christianlouis/DocuElevate/commit/8fcc223ef19cf609d8413fb6091eabfa0b34d4a6))
+
+
+## v0.172.6 (2026-03-24)
+
+### Bug Fixes
+
+- Resolve multiple test failures in imap_tasks, main lifespan, and API settings endpoints
+  ([`f041f28`](https://github.com/christianlouis/DocuElevate/commit/f041f28d9f64011df52506ead4bbc87d0797c20e))
+
+- Restore all code deleted/truncated by d2217531 Jules SSRF commit
+  ([`c7d3ec5`](https://github.com/christianlouis/DocuElevate/commit/c7d3ec57c3aca4faeaa0ad2fdbde3a1f770b86a5))
+
+- **migrations**: Restore accidentally deleted migration files 038-042
+  ([`11a49eb`](https://github.com/christianlouis/DocuElevate/commit/11a49eb7fd2218062922a9b8bf01b9a91572bea7))
+
+- **tasks**: Add -- end-of-options separator to ocrmypdf command in convert_to_pdfa
+  ([`7dec570`](https://github.com/christianlouis/DocuElevate/commit/7dec570ce6ae40b934ad075bc06f4cf1dfd9ff2e))
+
+### Code Style
+
+- Apply ruff auto-fix
+  ([`627a857`](https://github.com/christianlouis/DocuElevate/commit/627a8579def3a6a9d4f78da6469cfde889154402))
+
+
+## v0.172.5 (2026-03-23)
+
+### Bug Fixes
+
+- **main**: Suppress S110 ruff warnings with noqa comments for intentional try-except-pass
+  ([`0b8f967`](https://github.com/christianlouis/DocuElevate/commit/0b8f967eb5e304155752b4492584d4a7509a454c))
+
+- **settings**: Move os.path.exists inside try block in update_env_file so exceptions are non-fatal
+  ([`c9bb2b6`](https://github.com/christianlouis/DocuElevate/commit/c9bb2b6807b371d04edff12d16f838f411b60514))
+
+### Testing
+
+- **google_drive**: Fix exception handling test to expect non-fatal 200 like OneDrive equivalent
+  ([`2f5e2a0`](https://github.com/christianlouis/DocuElevate/commit/2f5e2a0fcdd9f9532fc55c6d7ce1675b8be3d3e8))
+
+- **main,imap**: Fix failing IMAP tests and add coverage for shutdown exception paths
+  ([`c03ce8c`](https://github.com/christianlouis/DocuElevate/commit/c03ce8cdb2e7849361ea50db888b7e3080eaafcd))
+
+
+## v0.172.4 (2026-03-23)
+
+### Bug Fixes
+
+- Resolve failing tests in main
+  ([`3be93be`](https://github.com/christianlouis/DocuElevate/commit/3be93be35a1564cb6009c5b7d2229820c2b8fafd))
+
+- **api/dropbox**: _require_admin bypasses auth when AUTH_ENABLED=False,
+  ([`3be93be`](https://github.com/christianlouis/DocuElevate/commit/3be93be35a1564cb6009c5b7d2229820c2b8fafd))
+
+### Chores
+
+- Simplify and fix naming for save settings endpoints
+  ([`341839f`](https://github.com/christianlouis/DocuElevate/commit/341839fe5edafa3451f89e2bb57092882d8fd6f0))
+
+- Simplify and fix naming for save settings endpoints
+  ([`57795ee`](https://github.com/christianlouis/DocuElevate/commit/57795ee4871bb0bb0727037a889542bf46a8bb9e))
+
+### Code Style
+
+- Apply ruff auto-fix
+  ([`2014a93`](https://github.com/christianlouis/DocuElevate/commit/2014a93c1ba4f41b8cfb589584be8d39baeaffe1))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`bcdbf9d`](https://github.com/christianlouis/DocuElevate/commit/bcdbf9d17885ab3f8750d8426c0ee9f181ced736))
+
+
+## Unreleased
+
+### Chores
+
+- Simplify and fix naming for save settings endpoints
+  ([`341839f`](https://github.com/christianlouis/DocuElevate/commit/341839fe5edafa3451f89e2bb57092882d8fd6f0))
+
+- Simplify and fix naming for save settings endpoints
+  ([`57795ee`](https://github.com/christianlouis/DocuElevate/commit/57795ee4871bb0bb0727037a889542bf46a8bb9e))
+
+
+## v0.172.3 (2026-03-23)
+
+### Bug Fixes
+
+- Improve join_url - use walrus op, remove posixpath.normpath
+  ([`15dd1a8`](https://github.com/christianlouis/DocuElevate/commit/15dd1a847133aa02aedf65e7fc75d857151cc26e))
+
+### Code Style
+
+- Apply ruff auto-fix
+  ([`b50a534`](https://github.com/christianlouis/DocuElevate/commit/b50a534454f0432e2ada8140e0090535b7c97051))
+
+- Apply ruff auto-fix
+  ([`326adb1`](https://github.com/christianlouis/DocuElevate/commit/326adb185853e17ac02d30b1bcce33b3a1cf4c5c))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`248619d`](https://github.com/christianlouis/DocuElevate/commit/248619d91e91aa9c5660267813367e4cd6f5040f))
+
+- **changelog**: Update changelog [skip ci]
+  ([`26963a8`](https://github.com/christianlouis/DocuElevate/commit/26963a84643c8c5caeb8536ed4dc55302a517adf))
+
+- **changelog**: Update changelog [skip ci]
+  ([`78bd5b5`](https://github.com/christianlouis/DocuElevate/commit/78bd5b5904d41d77d8df2a0e3978f630be080f0f))
+
+- **changelog**: Update changelog [skip ci]
+  ([`cc5e879`](https://github.com/christianlouis/DocuElevate/commit/cc5e879ea98507ec5656cce7162a69d385ee00f2))
+
+- **changelog**: Update changelog [skip ci]
+  ([`0497fbb`](https://github.com/christianlouis/DocuElevate/commit/0497fbbbad71fd728e528498508bbfc7802dab70))
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`26963a8`](https://github.com/christianlouis/DocuElevate/commit/26963a84643c8c5caeb8536ed4dc55302a517adf))
+
+- **changelog**: Update changelog [skip ci]
+  ([`78bd5b5`](https://github.com/christianlouis/DocuElevate/commit/78bd5b5904d41d77d8df2a0e3978f630be080f0f))
+
+- **changelog**: Update changelog [skip ci]
+  ([`cc5e879`](https://github.com/christianlouis/DocuElevate/commit/cc5e879ea98507ec5656cce7162a69d385ee00f2))
+
+- **changelog**: Update changelog [skip ci]
+  ([`0497fbb`](https://github.com/christianlouis/DocuElevate/commit/0497fbbbad71fd728e528498508bbfc7802dab70))
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`78bd5b5`](https://github.com/christianlouis/DocuElevate/commit/78bd5b5904d41d77d8df2a0e3978f630be080f0f))
+
+- **changelog**: Update changelog [skip ci]
+  ([`cc5e879`](https://github.com/christianlouis/DocuElevate/commit/cc5e879ea98507ec5656cce7162a69d385ee00f2))
+
+- **changelog**: Update changelog [skip ci]
+  ([`0497fbb`](https://github.com/christianlouis/DocuElevate/commit/0497fbbbad71fd728e528498508bbfc7802dab70))
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`cc5e879`](https://github.com/christianlouis/DocuElevate/commit/cc5e879ea98507ec5656cce7162a69d385ee00f2))
+
+- **changelog**: Update changelog [skip ci]
+  ([`0497fbb`](https://github.com/christianlouis/DocuElevate/commit/0497fbbbad71fd728e528498508bbfc7802dab70))
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`0497fbb`](https://github.com/christianlouis/DocuElevate/commit/0497fbbbad71fd728e528498508bbfc7802dab70))
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`45d3ac8`](https://github.com/christianlouis/DocuElevate/commit/45d3ac8cf07d39d49930dd6866f76e6015067b08))
+
+### Testing
+
+- Add assertions for task enqueuing parameters
+  ([`eeae47d`](https://github.com/christianlouis/DocuElevate/commit/eeae47ddec01339421e503ba484157e798750b8a))
+
+
+## Unreleased
+
+
+## v0.172.2 (2026-03-23)
+
+### Bug Fixes
+
+- Adapt TemplateResponse calls to Starlette 1.0 new-style API
+  ([`c4e10be`](https://github.com/christianlouis/DocuElevate/commit/c4e10bee5e096e71a5bc4fac4928f69e5c04f2fb))
+
+- Update test assertions and lint fixes for Starlette 1.0 TemplateResponse API
+  ([`93629ff`](https://github.com/christianlouis/DocuElevate/commit/93629ff44083d43f79fdd49431457023e53d13e4))
+
+- **build**: Remove --omit=dev from npm ci in Dockerfile frontend-builder stage
+  ([`b4e0067`](https://github.com/christianlouis/DocuElevate/commit/b4e0067a27e2fb161349bd38c6d3b3f3bcb86972))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`0841713`](https://github.com/christianlouis/DocuElevate/commit/084171395d1076c716aa500a516118db49468ff5))
+
+
+## Unreleased
+
+
+## v0.172.2 (2026-03-23)
+
+### Bug Fixes
+
+- Adapt TemplateResponse calls to Starlette 1.0 new-style API
+  ([`c4e10be`](https://github.com/christianlouis/DocuElevate/commit/c4e10bee5e096e71a5bc4fac4928f69e5c04f2fb))
+
+- Update test assertions and lint fixes for Starlette 1.0 TemplateResponse API
+  ([`93629ff`](https://github.com/christianlouis/DocuElevate/commit/93629ff44083d43f79fdd49431457023e53d13e4))
+
+- **build**: Remove --omit=dev from npm ci in Dockerfile frontend-builder stage
+  ([`b4e0067`](https://github.com/christianlouis/DocuElevate/commit/b4e0067a27e2fb161349bd38c6d3b3f3bcb86972))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`0841713`](https://github.com/christianlouis/DocuElevate/commit/084171395d1076c716aa500a516118db49468ff5))
+
+
+## Unreleased
+
+
+## v0.172.1 (2026-03-22)
+
+### Bug Fixes
+
+- Social login providers now work from DB config without restart
+  ([`0c7ea67`](https://github.com/christianlouis/DocuElevate/commit/0c7ea6748da554c80ef9af1b709c08aba49174e6))
+
+
+## v0.172.0 (2026-03-22)
+
+### Features
+
+- **ui**: Migrate Tailwind CSS from v2 CDN to v3 Play CDN (interim step)
+  ([`1d7df13`](https://github.com/christianlouis/DocuElevate/commit/1d7df13c943cc9138dc3ed514f9ab81d861bfbac))
+
+- **ui**: Replace Tailwind CSS CDN with compiled v3 production build
+  ([`14b3031`](https://github.com/christianlouis/DocuElevate/commit/14b3031e63e8645c4048dd73a594e9a53a919c17))
+
+
+## v0.171.3 (2026-03-22)
+
+### Bug Fixes
+
+- **ui**: Add missing opening script tag in base.html Sentry block
+  ([`425472c`](https://github.com/christianlouis/DocuElevate/commit/425472c839b3564c20a29b6e983fa6b9e7d6cf9c))
+
+
+## v0.171.2 (2026-03-22)
+
+### Bug Fixes
+
+- **ui**: Fix greyed-out toggle switches on admin connections page
+  ([`46772fc`](https://github.com/christianlouis/DocuElevate/commit/46772fc7461f9f8333b399b301ec969f5caa4c1e))
+
+### Chores
+
+- Upgrade Sentry Browser SDK CDN bundle from v9.x.x to v10.x.x
+  ([`3d0bdf7`](https://github.com/christianlouis/DocuElevate/commit/3d0bdf783649019d631fa0b1156db66e5e3269b4))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`25d32a9`](https://github.com/christianlouis/DocuElevate/commit/25d32a9006161b433dc6bbac3810ab560e5e5847))
+
+- **changelog**: Update changelog [skip ci]
+  ([`9822ba5`](https://github.com/christianlouis/DocuElevate/commit/9822ba583d076671692699cd9856d8fbc7d0218d))
+
+
+## Unreleased
+
+### Chores
+
+- Upgrade Sentry Browser SDK CDN bundle from v9.x.x to v10.x.x
+  ([`3d0bdf7`](https://github.com/christianlouis/DocuElevate/commit/3d0bdf783649019d631fa0b1156db66e5e3269b4))
+
+### Documentation
+
+- **changelog**: Update changelog [skip ci]
+  ([`9822ba5`](https://github.com/christianlouis/DocuElevate/commit/9822ba583d076671692699cd9856d8fbc7d0218d))
+
+
+## Unreleased
+
+### Chores
+
+- Upgrade Sentry Browser SDK CDN bundle from v9.x.x to v10.x.x
+  ([`3d0bdf7`](https://github.com/christianlouis/DocuElevate/commit/3d0bdf783649019d631fa0b1156db66e5e3269b4))
+
+
+## v0.171.1 (2026-03-22)
+
+### Bug Fixes
+
+- **admin**: Fix greyed-out QR login toggle on admin connections page
+  ([`d4cc44a`](https://github.com/christianlouis/DocuElevate/commit/d4cc44a72f7821360ffce1c9743efb85dbc65f22))
+
+
+## v0.171.0 (2026-03-22)
+
+### Features
+
+- **ui**: Show file owner, add claim ownership on file summary, detail, and annotations pages
+  ([`9458055`](https://github.com/christianlouis/DocuElevate/commit/9458055661e5458256b51cfe1965b0607d6a478e))
+
+
+## v0.170.0 (2026-03-22)
+
+### Features
+
+- **ui**: Integrate EmbedPDF viewer with annotations panel for bidirectional sync
+  ([`9c98a84`](https://github.com/christianlouis/DocuElevate/commit/9c98a8438ab81c70cc497191449378b914775731))
+
+
+## v0.169.1 (2026-03-22)
+
+### Bug Fixes
+
+- **api**: Add PUT /api/settings/{key} endpoint and shared credentials for Google/Microsoft social
+  login
+  ([`7d6128d`](https://github.com/christianlouis/DocuElevate/commit/7d6128d78f7782d4a687b51220747714ab59df6d))
+
+
 ## v0.169.0 (2026-03-22)
 
 ### Bug Fixes

Dockerfile

@@ -27,7 +27,21 @@ RUN pip install --no-cache-dir -r requirements.txt \
     && find /opt/venv -type f -name "*.pyc" -delete \
     && find /opt/venv -type d -name "__pycache__" -exec rm -rf {} + 2>/dev/null || true
 
-# ── Stage 2: Documentation builder ──────────────────────────────────────────
+# ── Stage 2: Frontend asset builder ─────────────────────────────────────────
+# Compiles Tailwind CSS (a devDependency) into the minified styles.css.
+# npm ci installs ALL deps (including devDependencies) so the tailwindcss CLI
+# is available; using --omit=dev would cause 'tailwindcss: not found'.
+FROM node:20-slim AS frontend-builder
+
+WORKDIR /frontend
+
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+
+COPY frontend/ ./
+RUN npm run build
+
+# ── Stage 4: Documentation builder ──────────────────────────────────────────
 FROM python:3.14.3-slim AS docs-builder
 
 WORKDIR /docs
@@ -43,7 +57,7 @@ COPY mkdocs.yml /docs/mkdocs.yml
 # Build the static documentation site
 RUN mkdocs build --config-file /docs/mkdocs.yml --site-dir /docs/docs_build
 
-# ── Stage 3: Runtime image ───────────────────────────────────────────────────
+# ── Stage 5: Runtime image ───────────────────────────────────────────────────
 FROM python:3.14.3-slim
 
 WORKDIR /app
@@ -81,6 +95,9 @@ COPY ./RUNTIME_INFO /app/RUNTIME_INFO
 # Copy the pre-built MkDocs documentation site (served at /help)
 COPY --from=docs-builder /docs/docs_build /app/docs_build
 
+# Copy the compiled Tailwind CSS (built in the frontend-builder stage)
+COPY --from=frontend-builder /frontend/static/styles.css /app/frontend/static/styles.css
+
 # Create necessary runtime directories in a single layer
 RUN mkdir -p /app/runtime_info /workdir
 

GIT_SHA

@@ -1 +1 @@
-4a35aab
+425805a

MILESTONES.md

@@ -1,6 +1,6 @@
 # DocuElevate Milestones
 
-**Last Updated:** 2026-02-08
+**Last Updated:** 2026-05-23
 
 This document outlines the release milestones, versioning strategy, and detailed feature breakdown for DocuElevate.
 
@@ -19,17 +19,15 @@ DocuElevate follows [Semantic Versioning 2.0.0](https://semver.org/):
 
 ---
 
-## Current Release: v0.5.0 (February 2026)
+## Current State (Continuous Releases)
 
-### Status: Stable
+DocuElevate ships continuously via automated semantic versioning. Use **GitHub Releases** for the latest build artifacts and **GitHub Milestones** (below) for roadmap tracking.
-- Production-ready document processing
+
-- Multi-provider storage support
+### Last Shipped Milestone: v0.5.0 (Released February 8, 2026)
-- **Database-backed settings management with encryption**
+- Database-backed settings management with encryption
-- **Setup wizard for first-time configuration**
+- Setup wizard for first-time configuration
-- **Admin UI for runtime configuration**
+- Admin UI for runtime configuration
-- **Automated semantic versioning and releases**
+- Release automation via semantic-release
-- OAuth2 authentication with admin group support
-- Basic web UI and REST API
 
 ### Important Note on Versioning
 As of February 2026, DocuElevate uses **automated semantic versioning**:
@@ -130,87 +128,78 @@ As of February 2026, DocuElevate uses **automated semantic versioning**:
 
 ## Upcoming Milestones
 
-### v0.6.0 - Enhanced Search & UI Improvements (April 2026)
+### v0.6.0 - Clarity: Enhanced Search & UI (Target: July 31, 2026)
-**Target Date:** April 1, 2026
+**Target Date:** July 31, 2026
 **Status:** 📋 Planned
-**Theme:** User Experience, Search, Performance
+**Theme:** Search, Discovery, Modern UX
+**Epic:** #863
 
 #### Goals
-- Implement full-text search across documents
+- Hybrid discovery: keyword + semantic search, fast filtering, saved searches
-- Responsive mobile interface
+- Preview-first UX (open, skim, and act quickly)
-- Dark mode support
+- Modern UX polish (accessibility, responsiveness, performance)
-- Document preview in browser
-- Performance optimizations
-- Improved error handling and user feedback
 
 #### Deliverables
-- Full-text search API and UI
+- Semantic search foundation (vectorization + ranking signals)
-- Advanced filtering capabilities
+- Saved searches / smart views
-- Responsive CSS framework integration
+- In-browser preview + “quick actions” (tag, route, export)
-- Dark mode toggle
+- Bulk operations and pagination improvements
-- In-browser document viewer
+- UX polish (dark mode/accessibility where applicable)
-- Loading states and progress indicators
-- Performance benchmarks
-- Mobile-optimized interface
 
 #### Breaking Changes
-- API response format changes for search endpoints (documented)
+- Potential pagination/search response changes (must be versioned and documented)
 
 #### Migration Path
-- Search endpoint changes will be versioned (/api/v1/search → /api/v2/search)
+- Version endpoints where needed and keep previous versions working for at least 2 minor milestones
-- Old endpoints deprecated but functional for 2 releases
 
 ---
 
-### v0.4.5 - Workflow Automation (June 2026)
+### v0.7.0 - Conductor: Workflow Automation & Integrations (Target: September 30, 2026)
-**Target Date:** June 1, 2026
+**Target Date:** September 30, 2026
 **Status:** 📋 Planned
 **Theme:** Automation, Integration, Webhooks
+**Epic:** #864
 
 #### Goals
-- Custom processing pipelines
+- First-class workflow model (steps, state, retries) that matches what the system actually executes
-- Conditional routing based on document type
+- Workflow-aware UI status, retries, and observability
-- Webhook support for external integrations
+- Webhooks + event-driven automation foundations
-- Rule-based classification
-- Scheduled batch processing
 
 #### Deliverables
-- Pipeline configuration UI
+- Workflow object model and storage
-- Webhook management interface
+- Workflow-aware file detail view + status dashboard
-- Rule engine for document routing
+- Scheduling primitives (recurring jobs / delayed runs)
-- Batch processing scheduler
+- Webhook system (outbound events + inbound triggers)
-- Integration examples and templates
+- Integration templates and documentation
-- Webhook payload documentation
 
 ---
 
-### v0.7.0 - Advanced AI & Multi-language (August 2026)
+### v0.8.0 - Signal: AI Quality, RAG, and Multi-language (Target: November 30, 2026)
-**Target Date:** August 1, 2026
+**Target Date:** November 30, 2026
 **Status:** 📋 Planned
-**Theme:** AI Enhancement, Internationalization
+**Theme:** AI Quality, Retrieval, Internationalization
+**Epic:** #865
 
 #### Goals
-- Custom AI model support
+- “Chat with Library” foundations (retrieval + UI)
-- Multi-language OCR
+- Local AI options for privacy-sensitive setups
-- Document similarity detection
+- Measurable AI quality (confidence + human review loop)
-- Duplicate detection
+- Expand multilingual capability across OCR + UI
-- UI internationalization (i18n)
-- API localization
 
 #### Deliverables
-- Custom model integration API
+- Vector DB integration and embeddings pipeline
-- Multi-language OCR configuration
+- Chat UI foundations and retrieval API
-- Similarity algorithm implementation
+- Confidence scoring + human review/edit loop for extracted fields
-- Duplicate detection service
+- Multi-language OCR configuration improvements
-- Translation framework (10+ languages)
+- Expanded i18n coverage + localized docs
-- Localized documentation
 
 ---
 
-### v1.0.0 - Enterprise Edition (November 2026)
+### v1.0.0 - Summit: Enterprise Edition (Target: March 31, 2027)
-**Target Date:** November 1, 2026
+**Target Date:** March 31, 2027
 **Status:** 📋 Planned
 **Theme:** Enterprise Features, Scalability, Multi-tenancy
+**Epic:** #866
 
 This is our first major release, marking production-ready enterprise capabilities.
 
@@ -244,6 +233,60 @@ This is our first major release, marking production-ready enterprise capabilitie
 
 ---
 
+### v2.0.0 - Horizon: Platform Expansion (Target: September 30, 2027)
+**Target Date:** September 30, 2027
+**Status:** 📋 Planned
+**Theme:** Ecosystem, Platform, Distribution
+**Epic:** #867
+
+#### Goals
+- Make DocuElevate extensible by design (plugins + templates)
+- Expand integrations and developer experience
+- Harden multi-surface experiences (web, mobile, extension, CLI) as a cohesive product
+
+#### Deliverables
+- Plugin system foundations and public extension points
+- Template library for pipelines/workflows + “starter kits”
+- Integration hub patterns (webhooks, events, connectors)
+- SDK + documentation for extensions
+
+---
+
+### v2.1.0 - Sentinel: Governance & Policy (Target: March 31, 2028)
+**Target Date:** March 31, 2028
+**Status:** 📋 Planned
+**Theme:** Governance, Compliance, Policy-driven Automation
+**Epic:** #868
+
+#### Goals
+- Make governance first-class (retention, legal hold, PII workflows)
+- Provide tamper-evident auditing and admin controls
+- Introduce policy-driven approvals for sensitive automation
+
+#### Deliverables
+- Retention policies + legal hold primitives
+- PII detection + redaction workflows
+- Tamper-evident audit trails + admin activity feed
+- Policy-as-code concepts for workflows (with approval gates)
+
+---
+
+### v3.0.0 - Constellation: Integration Hub & Agent Platform (Target: September 30, 2028)
+**Target Date:** September 30, 2028
+**Status:** 📋 Planned
+**Theme:** Ecosystem, Agents, Interoperability
+**Epic:** #869
+
+#### Goals
+- Make DocuElevate the “system of record” for document intelligence in an organization
+- Support external automation ecosystems (Zapier/Make/n8n) and agent runtimes
+- Provide a clean interoperability layer for modern AI tools
+
+#### Deliverables
+- DocuElevate MCP server (search, retrieve, summarize, route) and documentation
+- Connector marketplace concepts (curated + community)
+- Event stream + webhooks at scale (delivery guarantees, retries, signing)
+
 ## Release Process
 
 ### Automated Semantic Versioning (v0.6.0+)
@@ -255,15 +298,15 @@ Starting with v0.6.0, releases are fully automated using `python-semantic-releas
 4. **Automatic Updates**:
    - Updates `VERSION` file
    - Generates/updates `CHANGELOG.md`
-   - Creates Git tag (e.g., `v0.6.0`)
+   - Creates Git tag (e.g., `v0.173.1`)
    - Creates GitHub Release with notes
    - Triggers Docker image builds
 5. **No Manual Steps**: VERSION and CHANGELOG are never edited manually
 
 ### Version Bump Rules
-- `feat:` commits → Minor version (0.5.0 → 0.6.0)
+- `feat:` commits → Minor version (e.g., 0.173.1 → 0.174.0)
-- `fix:`, `perf:` → Patch version (0.5.0 → 0.5.1)
+- `fix:`, `perf:` → Patch version (e.g., 0.173.1 → 0.173.2)
-- `feat!:`, `BREAKING CHANGE:` → Major version (0.5.0 → 1.0.0)
+- `feat!:`, `BREAKING CHANGE:` → Major version (e.g., 0.173.1 → 1.0.0)
 - Other types (docs, chore, etc.) → No version bump
 
 ### Pre-release Checklist (Automated)
@@ -297,10 +340,13 @@ Starting with v0.6.0, releases are fully automated using `python-semantic-releas
 | v0.3.2 | 2026-02-06 | Security Updates | Released |
 | v0.3.3 | 2026-02-08 | Drag-and-Drop Upload | Released |
 | v0.5.0 | 2026-02-08 | **Settings & Encryption** | **Released** |
-| v0.6.0 | 2026-04 | Search & UX | Planned |
+| v0.6.0 | 2026-07-31 | **Clarity:** Search & UX | Planned |
-| v0.7.0 | 2026-08 | Advanced AI | Planned |
+| v0.7.0 | 2026-09-30 | **Conductor:** Workflows & Integrations | Planned |
-| v1.0.0 | 2026-11 | Enterprise | Planned |
+| v0.8.0 | 2026-11-30 | **Signal:** AI Quality, RAG, Multi-language | Planned |
-| v2.0.0 | 2027-Q3 | Platform Expansion | Future |
+| v1.0.0 | 2027-03-31 | **Summit:** Enterprise | Planned |
+| v2.0.0 | 2027-09-30 | **Horizon:** Platform Expansion | Future |
+| v2.1.0 | 2028-03-31 | **Sentinel:** Governance & Policy | Future |
+| v3.0.0 | 2028-09-30 | **Constellation:** Integration Hub & Agents | Future |
 
 ---
 

README.md

@@ -35,7 +35,7 @@ DocuElevate is an intelligent document processing system that automates the inge
 
 - **AI-Powered Metadata Extraction** — pluggable AI providers including OpenAI, Anthropic Claude, Google Gemini, Ollama (local), OpenRouter, Portkey, and Azure OpenAI via LiteLLM
 - **Multi-Engine OCR** — Azure Document Intelligence, Tesseract, EasyOCR, Mistral OCR, Google Cloud Document AI, and AWS Textract with configurable merge strategies
-- **12 Storage Destinations** — Dropbox, Google Drive, OneDrive, Amazon S3, Nextcloud, WebDAV, FTP, SFTP, iCloud Drive, Email (SMTP), Paperless-ngx, and Rclone
+- **13 Storage Destinations** — Dropbox, Google Drive, OneDrive, Amazon S3, Nextcloud, WebDAV, FTP, SFTP, iCloud Drive, Email (SMTP), Paperless-ngx, Evernote, and Rclone
 - **Multi-Channel Ingestion** — web upload, browser extension, mobile app, CLI, REST API, IMAP email, and watched folders (local, cloud, FTP/SFTP)
 - **Processing Pipelines** — customizable multi-step workflows with conditional routing rules
 - **Full-Text Search** — powered by Meilisearch for instant document discovery
@@ -106,6 +106,7 @@ Processed documents are distributed to any combination of configured destination
 | **iCloud Drive** | Apple cloud |
 | **Email (SMTP)** | Send as attachment |
 | **Paperless-ngx** | Document management system |
+| **Evernote** | Notes with PDF attachments |
 | **Rclone** | 70+ cloud providers via Rclone |
 
 ## Features
@@ -245,6 +246,7 @@ See the [Kubernetes Deployment Guide](docs/KubernetesDeployment.md) for full det
 | [Google Drive](docs/GoogleDriveSetup.md) | Google Drive service account / OAuth |
 | [OneDrive](docs/OneDriveSetup.md) | Microsoft OneDrive setup |
 | [Amazon S3](docs/AmazonS3Setup.md) | S3 bucket configuration |
+| [Evernote](docs/EvernoteSetup.md) | Evernote note creation |
 | [Authentication](docs/AuthenticationSetup.md) | OAuth2, OIDC, and social login |
 | [Notifications](docs/NotificationsSetup.md) | Notification backend setup |
 
@@ -327,6 +329,7 @@ The following is a summary of the licenses used by our direct dependencies:
 | pypdf      | BSD     |
 | Requests   | Apache 2.0 |
 | Dropbox SDK | MIT    |
+| Evernote SDK | BSD    |
 | Azure AI Document Intelligence | MIT |
 | Authlib    | BSD     |
 | Starlette  | BSD     |

ROADMAP.md

@@ -1,169 +1,139 @@
 # DocuElevate Roadmap
 
-**Last Updated:** 2026-02-08
+**Last Updated:** 2026-05-23
-**Version:** 1.0
+**Version:** 2.0
 
 ## Vision
 
 DocuElevate aims to be the premier open-source intelligent document processing platform, providing seamless integration with cloud storage providers, advanced AI-powered metadata extraction, and enterprise-grade security and scalability.
 
+## How to Read This Roadmap
+
+DocuElevate ships frequently (automated semantic versioning), so this roadmap is organized around **milestone outcomes** and **themes**, not exact build numbers.
+
+- **P0** = required for the milestone to feel “done”
+- **P1** = strongly desired; may slip if needed
+- **P2** = nice-to-have / opportunistic
+
+For the detailed milestone breakdown and target dates, see [MILESTONES.md](MILESTONES.md).
+
 ## Release Naming
 
 Each major milestone release carries a codename to anchor key project moments. These names appear in the status dashboard, build metadata, and changelog. For details, see [docs/ReleaseNaming.md](docs/ReleaseNaming.md).
 
-| Version Range | Codename      | Theme                                           |
+| Milestone | Codename        | Theme |
-|---------------|---------------|--------------------------------------------------|
+|----------|------------------|-------|
-| 0.5.x         | **Foundation** | Core platform, multi-provider storage, AI, UI   |
+| v0.6.0   | **Clarity**      | Search, discovery, and modern UX |
-| 0.6.x         | **Clarity**    | Enhanced search, filtering, UI/UX improvements  |
+| v0.7.0   | **Conductor**    | Workflows, orchestration, and integrations |
-| 0.7.x         | **Conductor**  | Workflow automation, pipelines, rule-based logic |
+| v0.8.0   | **Signal**       | AI quality, multilingual, and “Chat with Library” foundations |
-| 1.0.x         | **Summit**     | Enterprise features, multi-tenancy, RBAC        |
+| v1.0.0   | **Summit**       | Enterprise readiness (multi-tenancy, RBAC, scaling) |
-| 1.1.x         | **Bridge**     | Collaboration, sharing, analytics                |
+| v2.0.0   | **Horizon**      | Platform expansion and ecosystem maturity |
-| 2.0.x         | **Horizon**    | On-premise AI, platform expansion               |
+| v2.1.0+  | **Sentinel**     | Governance, compliance, and policy-driven automation |
+| v3.0.0   | **Constellation**| Integration hub, agents, and interoperability |
 
-## Current Status (v0.5.0 "Foundation")
+## Current Product Capabilities (Today)
 
 ### Core Features ✅
-- Multi-provider document storage (Dropbox, Google Drive, OneDrive, Nextcloud, S3, etc.)
+- Multi-channel ingestion (web upload, IMAP email, watched folders, mobile, CLI, API)
-- IMAP email integration for document ingestion
+- Multi-engine OCR + AI extraction with configurable providers
-- OCR processing via Azure Document Intelligence
+- Customizable processing pipelines and routing rules
-- AI-powered metadata extraction via OpenAI
+- Full-text search and document discovery
-- PDF conversion via Gotenberg
+- Multi-destination distribution (cloud providers, DMS, protocols, email)
-- Web UI for document upload and management
+- Admin UI for configuration (database-backed settings, encryption, setup wizard)
-- **Database-backed settings management with admin UI**
+- Production hardening building blocks (CI/CD, security docs, deployment guides)
-- **Fernet encryption for sensitive configuration**
-- **Setup wizard for first-time installation**
-- REST API with OpenAPI documentation
-- Celery-based async task processing
-- OAuth2 authentication via Authentik with admin group support
 
-## Short-term Goals (Q1-Q2 2026) - v0.4.x to v0.5.x "Foundation"
+## Feature Landscape (Themes)
 
-### Quality & Stability 🎯
+### 1) Search & Discovery
-- **Test Coverage** (High Priority)
+- **P0:** hybrid search (keyword + semantic), fast faceted filtering, saved searches
-  - [ ] Achieve 80% code coverage for core modules
+- **P1:** “explain results” (why a document matched), query suggestions, pinned results
-  - [ ] Add integration tests for all storage providers
+- **P2:** entity search (people/companies/amounts/dates) and graph-style exploration
-  - [ ] Add end-to-end workflow tests
-  - [ ] Performance benchmarks and load testing
 
-- **Code Quality** (High Priority)
+### 2) AI Quality & Trust
-  - [ ] Enable strict linting in CI/CD
+- **P0:** confidence scoring, human review/edit loop, extraction evaluation harness
-  - [ ] Refactor large modules for better maintainability
+- **P1:** per-document-type schemas/templates, active learning (feedback improves extraction)
-  - [ ] Add comprehensive type hints
+- **P2:** multi-model routing (choose model by cost/latency/accuracy per step)
-  - [ ] Improve error handling and user feedback
 
-- **Security** (Critical Priority)
+### 3) Workflow Automation & Orchestration
-  - [x] Fix known vulnerabilities in dependencies
+- **P0:** first-class workflow model (steps, state, retries), workflow-aware UI status
-  - [ ] Implement rate limiting on API endpoints
+- **P1:** visual workflow builder, scheduling, webhooks, and event-driven triggers
-  - [ ] Add CSRF protection
+- **P2:** agentic workflows (“autopilot” suggestions with approval gates)
-  - [ ] Security audit by external party
-  - [ ] Implement API key rotation
-  - [ ] Add audit logging for sensitive operations
 
-- **Release Automation** (Completed ✅)
+### 4) Integrations & Ecosystem (Including MCP)
-  - [x] Implement semantic-release for automated versioning
+- **P0:** stable webhooks + outbound actions (Slack/Teams, email, DMS), bi-directional sync where supported
-  - [x] Add conventional commit validation
+- **P1:** “Integration Hub” (Zapier/Make/n8n style), connector templates, secrets handling patterns
-  - [x] Automate CHANGELOG generation
+- **P2:** **MCP**: ship a DocuElevate MCP server (search, retrieve, summarize, route) + allow MCP tools as pipeline steps
-  - [x] Integrate Docker builds with releases
 
-### Features - v0.4.0
+### 5) Governance, Compliance, and Security
-- **Enhanced Search & Filtering** → _preparing for v0.6.0 "Clarity"_
+- **P0:** audit trails, tamper-evident logs, API key lifecycle/rotation, admin activity feed
-  - [ ] Full-text search across documents
+- **P1:** retention policies, legal hold, PII detection + redaction, data residency controls
-  - [ ] Advanced filtering by metadata, tags, date ranges
+- **P2:** compliance packs (SOC2/GDPR/HIPAA), BYOK/KMS integration paths
-  - [ ] Saved search queries
-  - [ ] Bulk operations on search results
 
-- **Improved UI/UX**
+### 6) Enterprise & Scale
-  - [ ] Responsive mobile interface
+- **P0:** multi-tenancy, RBAC, horizontal scaling reference architecture
-  - [ ] Dark mode support
+- **P1:** SCIM provisioning, SAML/Okta/Azure AD hardening, quotas/billing at org level
-  - [ ] Document preview in browser
+- **P2:** multi-region deployment patterns and disaster recovery playbooks
-  - [ ] Drag-and-drop file upload
-  - [ ] Progress indicators for long-running tasks
-  - [ ] Real-time notifications via WebSocket
 
-### Features - v0.5.0 "Foundation"
+## Release Plan (Extended)
-- **Workflow Automation** → _evolving into v0.7.0 "Conductor"_
-  - [ ] Custom processing pipelines
-  - [ ] Conditional routing based on document type
-  - [ ] Scheduled batch processing
-  - [ ] Webhook support for external integrations
-  - [ ] Rule-based document classification
 
-- **Advanced AI Features**
+This plan extends the existing milestones with a clearer thematic arc and a forward-looking “beyond v2.0” horizon. Each milestone links to an epic issue that owns scope and sub-issues.
-  - [ ] Custom AI models for specialized document types
-  - [ ] Multi-language OCR support
-  - [ ] Document similarity detection
-  - [ ] Automatic duplicate detection
-  - [ ] Intelligent document splitting
 
-## Medium-term Goals (Q3-Q4 2026) - v1.0.x "Summit"
+### v0.6.0 — Clarity (Search & UX)
+- **Outcome:** users can reliably find, preview, and act on documents in seconds
+- **P0:** semantic search + hybrid ranking, saved searches, fast filters, preview-first UX
+- **P1:** bulk operations, query suggestions, accessibility/dark mode polish
+- **Tracking:** GitHub milestone `v0.6.0 - Enhanced Search & UI` (epic #863)
 
-### Enterprise Features - v1.0.0 "Summit"
+### v0.7.0 — Conductor (Workflows & Integrations)
-- **Multi-tenancy**
+- **Outcome:** workflows are explicit, inspectable, and automatable end-to-end
-  - [ ] Organization/team management
+- **P0:** workflow object model + workflow-aware UI status, retries, pipeline definitions
-  - [ ] Role-based access control (RBAC)
+- **P1:** workflow builder, scheduling, inbound/outbound webhooks
-  - [ ] Per-tenant configuration
+- **P2:** integration templates + “connector marketplace” concepts
-  - [ ] Resource quotas and limits
+- **Tracking:** GitHub milestone `v0.7.0 - Workflow Automation` (epic #864)
-  - [ ] Audit logs per organization
 
-- **Scalability**
+### v0.8.0 — Signal (AI Quality + “Chat with Library” Foundations)
-  - [ ] Horizontal scaling support
+- **Outcome:** AI features are measurable, reviewable, and safe to trust
-  - [ ] Distributed task processing
+- **P0:** vector DB + embeddings pipeline, chat UI foundations, local AI options
-  - [ ] Caching layer (Redis/Memcached)
+- **P1:** confidence scoring and review loop, extraction evaluation harness
-  - [ ] Database connection pooling
+- **P2:** multilingual UX + localization expansion
-  - [ ] Message queue optimization
+- **Tracking:** GitHub milestone `v0.8.0 - Advanced AI & Multi-language` (epic #865)
 
-- **Advanced Integrations**
+### v1.0.0 — Summit (Enterprise Readiness)
-  - [ ] Microsoft SharePoint integration
+- **Outcome:** teams can run DocuElevate with strong isolation, access control, and scale
-  - [ ] Slack/Teams bot integration
+- **P0:** multi-tenancy, RBAC, audit logging, scaling guidance
-  - [ ] Zapier/Make.com integration
+- **P1:** SSO hardening (SAML/LDAP), org-level quotas and billing hooks
-  - [ ] Custom webhook receivers
+- **P2:** enterprise admin experience (policies, approvals, reporting)
-  - [ ] GraphQL API
+- **Tracking:** GitHub milestone `v1.0.0 - Enterprise Edition` (epic #866)
 
-### Features - v1.1.0 "Bridge"
+### v2.0.0 — Horizon (Platform Expansion)
-- **Collaboration**
+- **Outcome:** DocuElevate becomes an extensible platform with a thriving ecosystem
-  - [ ] Document sharing with expiring links
+- **P0:** plugin system foundations, SDK + templates, deeper integrations
-  - [ ] Comments and annotations
+- **P1:** marketplace patterns, app distribution, mobile/extension maturity
-  - [ ] Version history and rollback
+- **P2:** multi-workspace experiences (personal + org)
-  - [ ] Real-time collaborative editing metadata
+- **Tracking:** GitHub milestone `v2.0.0 - Platform Expansion` (epic #867)
-  - [ ] Activity feed
 
-- **Reporting & Analytics**
+### v2.1.0+ — Sentinel (Governance & Policy)
-  - [ ] Processing statistics dashboard
+- **Outcome:** governance becomes a first-class layer (policy-driven automation)
-  - [ ] Storage usage analytics
+- **P0:** retention + legal hold, PII detection/redaction, tamper-evident audit trails
-  - [ ] AI confidence scores and accuracy tracking
+- **P1:** BYOK/KMS integration patterns, advanced access policies, compliance reporting
-  - [ ] Cost analysis per provider
+- **P2:** “policy as code” for workflows + approvals (change management)
-  - [ ] Export reports (PDF, CSV, Excel)
+- **Tracking:** GitHub milestone `v2.1.0 - Governance & Policy (Sentinel)` (epic #868)
 
-## Long-term Goals (2027+) - v2.0+ "Horizon"
+### v3.0.0 — Constellation (Integration Hub & Agent Platform)
+- **Outcome:** DocuElevate plugs into modern automation and AI ecosystems as a first-class system of record
+- **P0:** MCP server, durable event stream + production-grade webhooks
+- **P1:** connector templates + curated catalog, agent-friendly permissioning and auditing
+- **P2:** bring-your-own-agent patterns (sandboxing, scoped credentials)
+- **Tracking:** GitHub milestone `v3.0.0 - Integration Hub & Agent Platform (Constellation)` (epic #869)
 
-### Strategic Initiatives
+## Research Bets (Optional / Experimental)
-- **On-Premise AI Models**
-  - [ ] Self-hosted OCR (Tesseract, EasyOCR)
-  - [ ] Local LLM integration (Ollama, LLaMA)
-  - [ ] GPU acceleration support
-  - [ ] Model fine-tuning interface
-  - [ ] Hybrid cloud/on-premise processing
 
-- **Advanced Document Management**
+These are longer-horizon bets that should only be productized if they prove real user value.
-  - [ ] Document lifecycle management
-  - [ ] Retention policies and auto-deletion
-  - [ ] Compliance templates (GDPR, HIPAA, SOC2)
-  - [ ] Digital signature support
-  - [ ] Encryption at rest and in transit
 
-- **Platform Expansion**
+- Knowledge graph over extracted entities (contracts ↔ vendors ↔ invoices)
-  - [ ] Desktop applications (Electron)
+- Auto-generated “case files” (collections) from intent (“tax 2025”, “project alpha”)
-  - [ ] Mobile apps (iOS/Android)
+- Privacy-preserving learning (federated patterns) to improve extraction quality
-  - [ ] Browser extensions
+- Document provenance (signing, attestations) and tamper detection
-  - [ ] Command-line interface (CLI)
-  - [ ] VS Code extension for developers
-
-### Research & Innovation
-- [ ] Machine learning for custom document types
-- [ ] Blockchain for document provenance
-- [ ] Federated learning for privacy-preserving AI
-- [ ] Edge computing support
-- [ ] Quantum-resistant encryption
 
 ## Community & Ecosystem
 

RUNTIME_INFO

@@ -1,10 +1,10 @@
 DocuElevate Build Information
 ==============================
-Version: 0.169.0
+Version: 0.173.4
-Build Date: 2026-03-22T14:46:09Z
+Build Date: 2026-06-01T03:41:15Z
-Git Commit: 4a35aabdaa92dfa55d1f3a332691df81e56f025a
+Git Commit: 425805ab23882944aee0cb02b5e497bc536549c0
-Git Short SHA: 4a35aab
+Git Short SHA: 425805a
 Git Branch: main
-Commit Date: 2026-03-22T15:45:45+01:00
+Commit Date: 2026-06-01T05:40:53+02:00
-Build Timestamp: 2026-03-22T14:46:09Z
+Build Timestamp: 2026-06-01T03:41:16Z
 ==============================

VERSION

@@ -1 +1 @@
-0.169.0
+0.173.4

app/api/billing.py

@@ -260,7 +260,7 @@ async def stripe_webhook(request: Request, db: Session = Depends(get_db)) -> dic
 @require_login
 async def billing_success(request: Request) -> Any:
     """Show a success page after a completed Stripe Checkout."""
-    return _templates.TemplateResponse("billing_success.html", {"request": request})
+    return _templates.TemplateResponse(request, "billing_success.html")
 
 
 # ---------------------------------------------------------------------------

app/api/dropbox.py

@@ -25,6 +25,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Ensure the caller is an admin. Raises 403 otherwise."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 def _build_dropbox_redirect_uri(request: Request) -> str:
     """Build the Dropbox OAuth callback redirect URI.
 
@@ -385,14 +396,14 @@ async def list_dropbox_folders(
 
 
 @router.post("/dropbox/save-settings")
-@require_login
 async def save_dropbox_settings(
     request: Request,
     refresh_token: Annotated[str, Form(...)],
+    _admin: AdminUser,
+    db: Session = Depends(get_db),
     app_key: Annotated[Optional[str], Form()] = None,
     app_secret: Annotated[Optional[str], Form()] = None,
     folder_path: Annotated[Optional[str], Form()] = None,
-    db: Session = Depends(get_db),
 ):
     """
     Save Dropbox settings to database (primary) and .env file (best-effort).

app/api/google_drive.py

@@ -23,6 +23,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Ensure the caller is an admin. Raises 403 otherwise."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 @router.post("/google-drive/exchange-token")
 @require_login
 async def exchange_google_drive_token(
@@ -362,15 +373,15 @@ def format_time_remaining(time_delta):
 
 
 @router.post("/google-drive/save-settings")
-@require_login
 async def save_google_drive_settings(
     request: Request,
     refresh_token: Annotated[str, Form(...)],
+    _admin: AdminUser,
+    db: Session = Depends(get_db),
     client_id: Annotated[Optional[str], Form()] = None,
     client_secret: Annotated[Optional[str], Form()] = None,
     folder_id: Annotated[Optional[str], Form()] = None,
     use_oauth: Annotated[str, Form()] = "true",
-    db: Session = Depends(get_db),
 ):
     """
     Save Google Drive settings to the .env file (best-effort) and persist to database.
@@ -403,9 +414,10 @@ async def save_google_drive_settings(
         if folder_id:
             drive_settings["GOOGLE_DRIVE_FOLDER_ID"] = folder_id
 
-        # Try to update the .env file, but don't fail if it doesn't exist (for Docker containers)
+        # Best-effort .env file write — failures here are non-fatal
-        if os.path.exists(env_path):
+        env_file_written = False
-            try:
+        try:
+            if os.path.exists(env_path):
                 logger.info(f"Updating Google Drive settings in {env_path}")
 
                 # Read the current .env file
@@ -438,12 +450,13 @@ async def save_google_drive_settings(
                     f.write("\n".join(new_env_lines) + "\n")
 
                 logger.info("Successfully updated Google Drive settings in .env file")
-            except Exception as e:
+                env_file_written = True
-                logger.warning(f"Failed to update .env file: {str(e)}, but will continue with in-memory update")
+            else:
-        else:
+                logger.warning(
-            logger.warning(
+                    f".env file not found at {env_path}, skipping file update but continuing with in-memory update"
-                f".env file not found at {env_path}, skipping file update but continuing with in-memory update"
+                )
-            )
+        except Exception as env_err:
+            logger.warning(f"Failed to write .env file (non-fatal): {env_err}")
 
         # Update the settings in memory (this always happens)
         if refresh_token:
@@ -481,7 +494,7 @@ async def save_google_drive_settings(
         return {
             "status": "success",
             "message": "Google Drive settings have been saved",
-            "in_memory_only": not os.path.exists(env_path),
+            "in_memory_only": not env_file_written,
         }
 
     except Exception as e:

app/api/imap_accounts.py

@@ -17,6 +17,7 @@ from sqlalchemy.orm import Session
 from app.database import get_db
 from app.models import UserImapAccount
 from app.utils.encryption import decrypt_value, encrypt_value
+from app.utils.network import is_private_ip
 from app.utils.subscription import get_tier, get_user_tier_id
 from app.utils.user_scope import get_current_owner_id
 
@@ -187,6 +188,11 @@ def _test_imap_connection(host: str, port: int, username: str, password: str, us
 
     Returns a dict with ``{"success": bool, "message": str}``.
     """
+
+    # Security: Prevent SSRF by blocking connections to internal IPs
+    if is_private_ip(host):
+        logger.warning("SSRF blocked: Attempt to connect to private IP %s", host)
+        return {"success": False, "message": "Connection error: Invalid hostname or IP address"}
     try:
         if use_ssl:
             mail = imaplib.IMAP4_SSL(host, port)

app/api/integrations.py

@@ -515,6 +515,12 @@ def _test_imap_connection(config: dict[str, Any] | None, credentials: dict[str,
     if not host or not username or not password:
         return {"success": False, "message": "Missing required fields: host, username, and password"}
 
+    from app.utils.network import is_private_ip
+
+    if is_private_ip(host):
+        logger.warning("SSRF blocked: Attempt to connect to private IP %s", host)
+        return {"success": False, "message": "Connection error: Invalid hostname or IP address"}
+
     try:
         if use_ssl:
             mail = imaplib.IMAP4_SSL(host, port)
@@ -543,17 +549,28 @@ def _test_s3_connection(config: dict[str, Any] | None, credentials: dict[str, An
     creds = credentials or {}
     bucket = cfg.get("bucket", "")
     region = cfg.get("region", "us-east-1")
+    endpoint_url = cfg.get("endpoint_url")
 
     if not bucket:
         return {"success": False, "message": "Missing required field: bucket"}
 
+    if endpoint_url:
+        from urllib.parse import urlparse
+
+        from app.utils.network import is_private_ip
+
+        parsed_url = urlparse(endpoint_url)
+        if parsed_url.hostname and is_private_ip(parsed_url.hostname):
+            logger.warning("SSRF blocked: Attempt to connect to private IP via S3 endpoint %s", endpoint_url)
+            return {"success": False, "message": "Connection error: Invalid endpoint URL or private IP"}
+
     try:
         client = boto3.client(
             "s3",
             region_name=region,
             aws_access_key_id=creds.get("access_key_id", ""),
             aws_secret_access_key=creds.get("secret_access_key", ""),
-            endpoint_url=cfg.get("endpoint_url"),
+            endpoint_url=endpoint_url,
         )
         client.head_bucket(Bucket=bucket)
         return {"success": True, "message": f"S3 bucket '{bucket}' is accessible"}

app/api/local_auth.py

@@ -101,9 +101,9 @@ async def signup_page(request: Request) -> Any:
     if not settings.allow_local_signup:
         return RedirectResponse(url="/login?error=Registration+is+not+enabled", status_code=302)
     return templates.TemplateResponse(
+        request,
         "signup.html",
-        {
+        context={
-            "request": request,
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -113,16 +113,16 @@ async def signup_page(request: Request) -> Any:
 @router.get("/verify-email-sent", include_in_schema=False)
 async def verify_email_sent_page(request: Request) -> Any:
     """Render the verify-email-sent confirmation page."""
-    return templates.TemplateResponse("verify_email_sent.html", {"request": request})
+    return templates.TemplateResponse(request, "verify_email_sent.html")
 
 
 @router.get("/forgot-username", include_in_schema=False)
 async def forgot_username_page(request: Request) -> Any:
     """Render the forgot-username page where users can request a username reminder email."""
     return templates.TemplateResponse(
+        request,
         "forgot_username.html",
-        {
+        context={
-            "request": request,
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -133,9 +133,9 @@ async def forgot_username_page(request: Request) -> Any:
 async def forgot_password_page(request: Request) -> Any:
     """Render the forgot-password page where users can request a reset email."""
     return templates.TemplateResponse(
+        request,
         "forgot_password.html",
-        {
+        context={
-            "request": request,
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,
         },
@@ -147,9 +147,9 @@ async def reset_password_page(request: Request) -> Any:
     """Render the password reset form page."""
     token = request.query_params.get("token", "")
     return templates.TemplateResponse(
+        request,
         "password_reset_form.html",
-        {
+        context={
-            "request": request,
             "token": token,
             "csrf_token": getattr(request.state, "csrf_token", ""),
             "app_version": settings.version,

app/api/onedrive.py

@@ -25,6 +25,17 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _require_admin(request: Request) -> dict:
+    """Ensure the caller is an admin. Raises 403 otherwise."""
+    user = request.session.get("user")
+    if not user or not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin access required")
+    return user
+
+
+AdminUser = Annotated[dict, Depends(_require_admin)]
+
+
 @router.post("/onedrive/exchange-token")
 @require_login
 async def exchange_onedrive_token(
@@ -302,15 +313,15 @@ def format_time_remaining(time_delta):
 
 
 @router.post("/onedrive/save-settings")
-@require_login
 async def save_onedrive_settings(
     request: Request,
     refresh_token: Annotated[str, Form(...)],
+    _admin: AdminUser,
+    db: Session = Depends(get_db),
     client_id: Annotated[Optional[str], Form()] = None,
     client_secret: Annotated[Optional[str], Form()] = None,
     tenant_id: Annotated[str, Form()] = "common",
     folder_path: Annotated[Optional[str], Form()] = None,
-    db: Session = Depends(get_db),
 ):
     """
     Saves to database (primary) and .env file (best-effort).

app/api/qr_auth.py

@@ -31,6 +31,7 @@ from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session
 
 from app.auth import require_login
+from app.config import settings
 from app.database import get_db
 from app.middleware.audit_log import get_client_ip
 from app.utils.session_manager import (
@@ -151,6 +152,11 @@ async def create_challenge(
     displayed to the user.  The mobile app scans this QR code and
     calls the ``/claim`` endpoint.
     """
+    if not settings.qr_login_enabled:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="QR login feature is currently disabled. Please contact your administrator to enable it.",
+        )
     ip = get_client_ip(request)
     challenge = create_qr_challenge(db, owner_id, ip_address=ip)
 
@@ -187,6 +193,11 @@ async def poll_challenge_status(
     The web UI calls this endpoint every few seconds to check if the
     mobile app has scanned the QR code and claimed the challenge.
     """
+    if not settings.qr_login_enabled:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="QR login feature is currently disabled. Please contact your administrator to enable it.",
+        )
     result = get_challenge_status(db, challenge_id, owner_id)
     if not result:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Challenge not found")
@@ -206,6 +217,11 @@ async def claim_challenge(
     serves as proof that the user authorized this login from their web
     session.
     """
+    if not settings.qr_login_enabled:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="QR login feature is currently disabled. Please contact your administrator to enable it.",
+        )
     ip = get_client_ip(request)
     result = claim_qr_challenge(db, body.challenge_token, device_name=body.device_name, ip_address=ip)
 

app/api/subscriptions.py

@@ -9,7 +9,7 @@ Public endpoints:
 """
 
 import logging
-from datetime import datetime, timezone
+from datetime import datetime, time, timedelta, timezone
 from typing import Annotated, Any
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
@@ -207,19 +207,29 @@ def platform_stats(request: Request, db: DbSession, _admin: AdminUser) -> dict[s
     from app.models import FileRecord, UserProfile
 
     today = datetime.now(timezone.utc).date()
+    day_start = datetime.combine(today, time.min, tzinfo=timezone.utc)
+    day_end = day_start + timedelta(days=1)
+    month_start = day_start.replace(day=1)
+    if month_start.month == 12:
+        month_end = month_start.replace(year=month_start.year + 1, month=1)
+    else:
+        month_end = month_start.replace(month=month_start.month + 1)
 
     # Total files
     total_files: int = db.query(func.count(FileRecord.id)).scalar() or 0
 
     # Files today
     files_today: int = (
-        db.query(func.count(FileRecord.id)).filter(func.date(FileRecord.created_at) == today).scalar() or 0
+        db.query(func.count(FileRecord.id))
+        .filter(FileRecord.created_at >= day_start, FileRecord.created_at < day_end)
+        .scalar()
+        or 0
     )
 
     # Files this month
     files_this_month: int = (
         db.query(func.count(FileRecord.id))
-        .filter(func.strftime("%Y-%m", FileRecord.created_at) == today.strftime("%Y-%m"))
+        .filter(FileRecord.created_at >= month_start, FileRecord.created_at < month_end)
         .scalar()
         or 0
     )

app/api/url_upload.py

@@ -28,6 +28,10 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+class UnsafeRedirectError(httpx.RequestError):
+    """Raised when a redirect target fails URL safety checks."""
+
+
 class URLUploadRequest(BaseModel):
     """Request model for URL-based file upload"""
 
@@ -106,6 +110,26 @@ def validate_file_type(content_type: str, filename: str) -> bool:
     return False
 
 
+async def verify_redirect(response: httpx.Response) -> None:
+    """
+    Event hook to intercept redirects and validate the new destination URL.
+    Prevents SSRF bypasses via redirects to internal networks or metadata endpoints.
+    """
+    if response.status_code in (301, 302, 303, 307, 308):
+        location = response.headers.get("Location")
+        if location:
+            # Resolve relative redirects
+            new_url = str(response.url.join(location))
+            # Validate the new URL
+            try:
+                validate_url_safety(new_url)
+            except HTTPException as e:
+                raise UnsafeRedirectError(
+                    f"Redirect to unsafe URL blocked: {e.detail}",
+                    request=response.request,
+                ) from e
+
+
 @router.post("/process-url")
 @require_login
 async def process_url(
@@ -162,6 +186,7 @@ async def process_url(
         async with httpx.AsyncClient(
             timeout=settings.http_request_timeout,
             follow_redirects=True,
+            event_hooks={"response": [verify_redirect]},
             headers={
                 "User-Agent": "DocuElevate/1.0",  # Identify ourselves
             },
@@ -251,6 +276,10 @@ async def process_url(
         logger.error(f"HTTP error while downloading file from URL: {url} - {str(e)}")
         raise HTTPException(status_code=e.response.status_code, detail=f"HTTP error: {str(e)}")
 
+    except UnsafeRedirectError as e:
+        logger.warning(f"Unsafe redirect blocked while downloading file from URL: {url} - {str(e)}")
+        raise HTTPException(status_code=400, detail=str(e))
+
     except httpx.RequestError as e:
         logger.error(f"Error downloading file from URL: {url} - {str(e)}")
         raise HTTPException(status_code=500, detail=f"Failed to download file: {str(e)}")

app/auth.py

@@ -45,78 +45,27 @@ OAUTH_PROVIDER_NAME = "Single Sign-On"
 # Social login providers that are enabled and registered
 SOCIAL_PROVIDERS: dict[str, dict[str, str]] = {}
 
-if AUTH_ENABLED and settings.authentik_client_id and settings.authentik_client_secret:
-    oauth.register(
-        name="authentik",
-        client_id=settings.authentik_client_id,
-        client_secret=settings.authentik_client_secret,
-        server_metadata_url=settings.authentik_config_url,
-        client_kwargs={"scope": "openid profile email"},
-    )
-    OAUTH_CONFIGURED = True
-    OAUTH_PROVIDER_NAME = settings.oauth_provider_name or "Authentik SSO"
 
-# --- Social Login Providers ---------------------------------------------------
+# ---------------------------------------------------------------------------
-if AUTH_ENABLED and settings.social_auth_google_enabled:
+# Helpers for dynamic (re-)registration of OAuth providers
-    # Determine which credentials to use for Google social login
+# ---------------------------------------------------------------------------
-    _google_client_id = settings.social_auth_google_client_id
-    _google_client_secret = settings.social_auth_google_client_secret
-    if settings.social_auth_google_use_global_credentials and not (_google_client_id and _google_client_secret):
-        _google_client_id = settings.google_drive_client_id
-        _google_client_secret = settings.google_drive_client_secret
 
-    if _google_client_id and _google_client_secret:
-        oauth.register(
-            name="google",
-            client_id=_google_client_id,
-            client_secret=_google_client_secret,
-            server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
-            client_kwargs={"scope": "openid profile email"},
-        )
-        SOCIAL_PROVIDERS["google"] = {"name": "Google", "icon": "fab fa-google", "color": "red"}
-        logger.info("Social login provider registered: Google")
-    else:
-        logger.warning("SOCIAL_AUTH_GOOGLE_ENABLED=true but client ID/secret not configured")
 
-if AUTH_ENABLED and settings.social_auth_microsoft_enabled:
+def _register_oauth_client(name: str, **kwargs: object) -> None:
-    # Determine which credentials to use for Microsoft social login
+    """Register (or re-register) an authlib OAuth client, clearing any cached instance.
-    _microsoft_client_id = settings.social_auth_microsoft_client_id
-    _microsoft_client_secret = settings.social_auth_microsoft_client_secret
-    if settings.social_auth_microsoft_use_global_credentials and not (
-        _microsoft_client_id and _microsoft_client_secret
-    ):
-        _microsoft_client_id = settings.onedrive_client_id
-        _microsoft_client_secret = settings.onedrive_client_secret
 
-    if _microsoft_client_id and _microsoft_client_secret:
+    authlib caches the constructed client object in ``oauth._clients`` after the
-        tenant = settings.social_auth_microsoft_tenant or "common"
+    first ``register()`` call.  Subsequent ``register()`` calls overwrite the
-        oauth.register(
+    registry entry but the stale cached client is still returned by
-            name="microsoft",
+    ``create_client()`` / ``__getattr__``.  Popping the name from ``_clients``
-            client_id=_microsoft_client_id,
+    before re-registering ensures the new credentials are picked up immediately.
-            client_secret=_microsoft_client_secret,
-            server_metadata_url=f"https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration",
-            client_kwargs={"scope": "openid profile email"},
-        )
-        SOCIAL_PROVIDERS["microsoft"] = {"name": "Microsoft", "icon": "fab fa-microsoft", "color": "blue"}
-        logger.info("Social login provider registered: Microsoft (tenant=%s)", tenant)
-    else:
-        logger.warning("SOCIAL_AUTH_MICROSOFT_ENABLED=true but client ID/secret not configured")
 
-if AUTH_ENABLED and settings.social_auth_apple_enabled:
+    Args:
-    if settings.social_auth_apple_client_id and settings.social_auth_apple_team_id:
+        name: Provider name (e.g. ``"google"``, ``"github"``).
-        oauth.register(
+        **kwargs: Keyword arguments forwarded verbatim to ``oauth.register()``.
-            name="apple",
+    """
-            client_id=settings.social_auth_apple_client_id,
+    oauth._clients.pop(name, None)
-            server_metadata_url="https://appleid.apple.com/.well-known/openid-configuration",
+    oauth.register(name, **kwargs)
-            client_kwargs={
-                "scope": "openid name email",
-                "response_mode": "form_post",
-            },
-        )
-        SOCIAL_PROVIDERS["apple"] = {"name": "Apple", "icon": "fab fa-apple", "color": "gray"}
-        logger.info("Social login provider registered: Apple")
-    else:
-        logger.warning("SOCIAL_AUTH_APPLE_ENABLED=true but client ID/team ID not configured")
 
 
 def _dropbox_userinfo_compliance_fix(client, user_cls, token, data):
@@ -145,92 +94,215 @@ def _dropbox_userinfo_compliance_fix(client, user_cls, token, data):
     return data
 
 
-if AUTH_ENABLED and settings.social_auth_dropbox_enabled:
+def _setup_social_providers() -> None:
-    # Determine which credentials to use for Dropbox social login
+    """Register all configured OAuth / social-login providers from current settings.
-    _dropbox_client_id = settings.social_auth_dropbox_client_id
-    _dropbox_client_secret = settings.social_auth_dropbox_client_secret
-    if settings.social_auth_dropbox_use_global_credentials and not (_dropbox_client_id and _dropbox_client_secret):
-        _dropbox_client_id = settings.dropbox_app_key
-        _dropbox_client_secret = settings.dropbox_app_secret
 
-    if _dropbox_client_id and _dropbox_client_secret:
+    This function is **idempotent**: it clears ``SOCIAL_PROVIDERS``,
-        oauth.register(
+    ``OAUTH_CONFIGURED``, and ``OAUTH_PROVIDER_NAME`` before rebuilding them,
-            name="dropbox",
+    and calls :func:`_register_oauth_client` (which also clears the authlib
-            client_id=_dropbox_client_id,
+    client cache) so that credential changes in the database are reflected
-            client_secret=_dropbox_client_secret,
+    without an application restart.
-            authorize_url="https://www.dropbox.com/oauth2/authorize",
-            access_token_url="https://api.dropboxapi.com/oauth2/token",
-            userinfo_endpoint="https://api.dropboxapi.com/2/users/get_current_account",
-            userinfo_compliance_fix=_dropbox_userinfo_compliance_fix,
-            client_kwargs={
-                "token_endpoint_auth_method": "client_secret_post",
-                "token_access_type": "offline",
-            },
-        )
-        SOCIAL_PROVIDERS["dropbox"] = {"name": "Dropbox", "icon": "fab fa-dropbox", "color": "blue"}
-        logger.info("Social login provider registered: Dropbox")
-    else:
-        logger.warning("SOCIAL_AUTH_DROPBOX_ENABLED=true but client ID/secret not configured")
 
-if AUTH_ENABLED and settings.social_auth_github_enabled:
+    Can safely be called multiple times, e.g. after a settings reload.
-    if settings.social_auth_github_client_id and settings.social_auth_github_client_secret:
+    """
-        oauth.register(
+    global OAUTH_CONFIGURED, OAUTH_PROVIDER_NAME
-            name="github",
-            client_id=settings.social_auth_github_client_id,
-            client_secret=settings.social_auth_github_client_secret,
-            authorize_url="https://github.com/login/oauth/authorize",
-            access_token_url="https://github.com/login/oauth/access_token",
-            userinfo_endpoint="https://api.github.com/user",
-            client_kwargs={"scope": "read:user user:email"},
-        )
-        SOCIAL_PROVIDERS["github"] = {"name": "GitHub", "icon": "fab fa-github", "color": "gray"}
-        logger.info("Social login provider registered: GitHub")
-    else:
-        logger.warning("SOCIAL_AUTH_GITHUB_ENABLED=true but client ID/secret not configured")
 
-if AUTH_ENABLED and settings.social_auth_keycloak_enabled:
+    SOCIAL_PROVIDERS.clear()
-    _kc_server = settings.social_auth_keycloak_server_url
+    OAUTH_CONFIGURED = False
-    _kc_realm = settings.social_auth_keycloak_realm
+    OAUTH_PROVIDER_NAME = "Single Sign-On"
-    if (
+
-        settings.social_auth_keycloak_client_id
+    if not AUTH_ENABLED:
-        and settings.social_auth_keycloak_client_secret
+        return
-        and _kc_server
+
-        and _kc_realm
+    # --- Authentik / OIDC ---
-    ):
+    if settings.authentik_client_id and settings.authentik_client_secret:
-        _kc_base = f"{_kc_server.rstrip('/')}/realms/{_kc_realm}"
+        _register_oauth_client(
-        oauth.register(
+            "authentik",
-            name="keycloak",
+            client_id=settings.authentik_client_id,
-            client_id=settings.social_auth_keycloak_client_id,
+            client_secret=settings.authentik_client_secret,
-            client_secret=settings.social_auth_keycloak_client_secret,
+            server_metadata_url=settings.authentik_config_url,
-            server_metadata_url=f"{_kc_base}/.well-known/openid-configuration",
             client_kwargs={"scope": "openid profile email"},
         )
-        SOCIAL_PROVIDERS["keycloak"] = {"name": "Keycloak", "icon": "fas fa-key", "color": "gray"}
+        OAUTH_CONFIGURED = True
-        logger.info("Social login provider registered: Keycloak (realm=%s)", _kc_realm)
+        OAUTH_PROVIDER_NAME = settings.oauth_provider_name or "Authentik SSO"
-    else:
-        logger.warning("SOCIAL_AUTH_KEYCLOAK_ENABLED=true but required settings not configured")
 
-if AUTH_ENABLED and settings.social_auth_generic_oauth2_enabled:
+    # --- Social Login Providers ---
-    if (
+
-        settings.social_auth_generic_oauth2_client_id
+    # Google
-        and settings.social_auth_generic_oauth2_client_secret
+    if settings.social_auth_google_enabled:
-        and settings.social_auth_generic_oauth2_authorize_url
+        _google_client_id = settings.social_auth_google_client_id
-        and settings.social_auth_generic_oauth2_token_url
+        _google_client_secret = settings.social_auth_google_client_secret
-    ):
+        if settings.social_auth_google_use_global_credentials and not (_google_client_id and _google_client_secret):
-        oauth.register(
+            _google_client_id = settings.google_drive_client_id
-            name="generic_oauth2",
+            _google_client_secret = settings.google_drive_client_secret
-            client_id=settings.social_auth_generic_oauth2_client_id,
+
-            client_secret=settings.social_auth_generic_oauth2_client_secret,
+        if _google_client_id and _google_client_secret:
-            authorize_url=settings.social_auth_generic_oauth2_authorize_url,
+            _register_oauth_client(
-            access_token_url=settings.social_auth_generic_oauth2_token_url,
+                "google",
-            userinfo_endpoint=settings.social_auth_generic_oauth2_userinfo_url,
+                client_id=_google_client_id,
-            client_kwargs={"scope": settings.social_auth_generic_oauth2_scope},
+                client_secret=_google_client_secret,
-        )
+                server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
-        _generic_name = settings.social_auth_generic_oauth2_name or "OAuth2"
+                client_kwargs={"scope": "openid profile email"},
-        SOCIAL_PROVIDERS["generic_oauth2"] = {"name": _generic_name, "icon": "fas fa-sign-in-alt", "color": "indigo"}
+            )
-        logger.info("Social login provider registered: Generic OAuth2 (%s)", _generic_name)
+            SOCIAL_PROVIDERS["google"] = {"name": "Google", "icon": "fab fa-google", "color": "red"}
-    else:
+            logger.info("Social login provider registered: Google")
-        logger.warning("SOCIAL_AUTH_GENERIC_OAUTH2_ENABLED=true but required settings not configured")
+        else:
+            logger.warning("SOCIAL_AUTH_GOOGLE_ENABLED=true but client ID/secret not configured")
+
+    # Microsoft
+    if settings.social_auth_microsoft_enabled:
+        _microsoft_client_id = settings.social_auth_microsoft_client_id
+        _microsoft_client_secret = settings.social_auth_microsoft_client_secret
+        if settings.social_auth_microsoft_use_global_credentials and not (
+            _microsoft_client_id and _microsoft_client_secret
+        ):
+            _microsoft_client_id = settings.onedrive_client_id
+            _microsoft_client_secret = settings.onedrive_client_secret
+
+        if _microsoft_client_id and _microsoft_client_secret:
+            tenant = settings.social_auth_microsoft_tenant or "common"
+            _register_oauth_client(
+                "microsoft",
+                client_id=_microsoft_client_id,
+                client_secret=_microsoft_client_secret,
+                server_metadata_url=f"https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration",
+                client_kwargs={"scope": "openid profile email"},
+            )
+            SOCIAL_PROVIDERS["microsoft"] = {"name": "Microsoft", "icon": "fab fa-microsoft", "color": "blue"}
+            logger.info("Social login provider registered: Microsoft (tenant=%s)", tenant)
+        else:
+            logger.warning("SOCIAL_AUTH_MICROSOFT_ENABLED=true but client ID/secret not configured")
+
+    # Apple
+    if settings.social_auth_apple_enabled:
+        if settings.social_auth_apple_client_id and settings.social_auth_apple_team_id:
+            _register_oauth_client(
+                "apple",
+                client_id=settings.social_auth_apple_client_id,
+                server_metadata_url="https://appleid.apple.com/.well-known/openid-configuration",
+                client_kwargs={
+                    "scope": "openid name email",
+                    "response_mode": "form_post",
+                },
+            )
+            SOCIAL_PROVIDERS["apple"] = {"name": "Apple", "icon": "fab fa-apple", "color": "gray"}
+            logger.info("Social login provider registered: Apple")
+        else:
+            logger.warning("SOCIAL_AUTH_APPLE_ENABLED=true but client ID/team ID not configured")
+
+    # Dropbox
+    if settings.social_auth_dropbox_enabled:
+        _dropbox_client_id = settings.social_auth_dropbox_client_id
+        _dropbox_client_secret = settings.social_auth_dropbox_client_secret
+        if settings.social_auth_dropbox_use_global_credentials and not (_dropbox_client_id and _dropbox_client_secret):
+            _dropbox_client_id = settings.dropbox_app_key
+            _dropbox_client_secret = settings.dropbox_app_secret
+
+        if _dropbox_client_id and _dropbox_client_secret:
+            _register_oauth_client(
+                "dropbox",
+                client_id=_dropbox_client_id,
+                client_secret=_dropbox_client_secret,
+                authorize_url="https://www.dropbox.com/oauth2/authorize",
+                access_token_url="https://api.dropboxapi.com/oauth2/token",
+                userinfo_endpoint="https://api.dropboxapi.com/2/users/get_current_account",
+                userinfo_compliance_fix=_dropbox_userinfo_compliance_fix,
+                client_kwargs={
+                    "token_endpoint_auth_method": "client_secret_post",
+                    "token_access_type": "offline",
+                },
+            )
+            SOCIAL_PROVIDERS["dropbox"] = {"name": "Dropbox", "icon": "fab fa-dropbox", "color": "blue"}
+            logger.info("Social login provider registered: Dropbox")
+        else:
+            logger.warning("SOCIAL_AUTH_DROPBOX_ENABLED=true but client ID/secret not configured")
+
+    # GitHub
+    if settings.social_auth_github_enabled:
+        if settings.social_auth_github_client_id and settings.social_auth_github_client_secret:
+            _register_oauth_client(
+                "github",
+                client_id=settings.social_auth_github_client_id,
+                client_secret=settings.social_auth_github_client_secret,
+                authorize_url="https://github.com/login/oauth/authorize",
+                access_token_url="https://github.com/login/oauth/access_token",
+                userinfo_endpoint="https://api.github.com/user",
+                client_kwargs={"scope": "read:user user:email"},
+            )
+            SOCIAL_PROVIDERS["github"] = {"name": "GitHub", "icon": "fab fa-github", "color": "gray"}
+            logger.info("Social login provider registered: GitHub")
+        else:
+            logger.warning("SOCIAL_AUTH_GITHUB_ENABLED=true but client ID/secret not configured")
+
+    # Keycloak
+    if settings.social_auth_keycloak_enabled:
+        _kc_server = settings.social_auth_keycloak_server_url
+        _kc_realm = settings.social_auth_keycloak_realm
+        if (
+            settings.social_auth_keycloak_client_id
+            and settings.social_auth_keycloak_client_secret
+            and _kc_server
+            and _kc_realm
+        ):
+            _kc_base = f"{_kc_server.rstrip('/')}/realms/{_kc_realm}"
+            _register_oauth_client(
+                "keycloak",
+                client_id=settings.social_auth_keycloak_client_id,
+                client_secret=settings.social_auth_keycloak_client_secret,
+                server_metadata_url=f"{_kc_base}/.well-known/openid-configuration",
+                client_kwargs={"scope": "openid profile email"},
+            )
+            SOCIAL_PROVIDERS["keycloak"] = {"name": "Keycloak", "icon": "fas fa-key", "color": "gray"}
+            logger.info("Social login provider registered: Keycloak (realm=%s)", _kc_realm)
+        else:
+            logger.warning("SOCIAL_AUTH_KEYCLOAK_ENABLED=true but required settings not configured")
+
+    # Generic OAuth2
+    if settings.social_auth_generic_oauth2_enabled:
+        if (
+            settings.social_auth_generic_oauth2_client_id
+            and settings.social_auth_generic_oauth2_client_secret
+            and settings.social_auth_generic_oauth2_authorize_url
+            and settings.social_auth_generic_oauth2_token_url
+        ):
+            _register_oauth_client(
+                "generic_oauth2",
+                client_id=settings.social_auth_generic_oauth2_client_id,
+                client_secret=settings.social_auth_generic_oauth2_client_secret,
+                authorize_url=settings.social_auth_generic_oauth2_authorize_url,
+                access_token_url=settings.social_auth_generic_oauth2_token_url,
+                userinfo_endpoint=settings.social_auth_generic_oauth2_userinfo_url,
+                client_kwargs={"scope": settings.social_auth_generic_oauth2_scope},
+            )
+            _generic_name = settings.social_auth_generic_oauth2_name or "OAuth2"
+            SOCIAL_PROVIDERS["generic_oauth2"] = {
+                "name": _generic_name,
+                "icon": "fas fa-sign-in-alt",
+                "color": "indigo",
+            }
+            logger.info("Social login provider registered: Generic OAuth2")
+        else:
+            logger.warning("SOCIAL_AUTH_GENERIC_OAUTH2_ENABLED=true but required settings not configured")
+
+
+def refresh_social_providers() -> None:
+    """Re-register all OAuth providers from the *current* settings object.
+
+    Call this after loading or reloading settings from the database so that
+    providers configured (or updated) through the admin UI take effect
+    immediately — **no application restart required**.
+
+    This function is safe to call multiple times and is idempotent.
+    """
+    logger.info("Refreshing social login provider registrations from current settings")
+    _setup_social_providers()
+
+
+# Perform the initial registration from environment / default settings at
+# import time.  The lifespan hook and settings_sync will call
+# refresh_social_providers() again after DB settings are loaded so that
+# any providers configured only in the database are also active.
+_setup_social_providers()
 
 router = APIRouter()
 
@@ -464,9 +536,9 @@ async def login(request: Request):
         return RedirectResponse(url="/oauth-login", status_code=status.HTTP_302_FOUND)
 
     return templates.TemplateResponse(
+        request,
         "login.html",
-        {
+        context={
-            "request": request,
             "error": error,
             "message": message,
             "show_oauth": show_oauth,

app/celery_worker.py

@@ -46,6 +46,7 @@ from app.tasks.translate_to_default_language import translate_to_default_languag
 # Import new send tasks
 from app.tasks.upload_to_dropbox import upload_to_dropbox  # noqa: F401
 from app.tasks.upload_to_email import upload_to_email  # noqa: F401
+from app.tasks.upload_to_evernote import upload_to_evernote  # noqa: F401
 from app.tasks.upload_to_ftp import upload_to_ftp  # noqa: F401
 from app.tasks.upload_to_google_drive import upload_to_google_drive  # noqa: F401
 from app.tasks.upload_to_icloud import upload_to_icloud  # noqa: F401

app/config.py

@@ -154,6 +154,17 @@ class Settings(BaseSettings):
     #           "language": "Language", "correspondent": "Correspondent"}
     paperless_custom_fields_mapping: Optional[str] = None
 
+    # Evernote destination settings
+    evernote_enabled: bool = Field(
+        default=True,
+        description="Enable Evernote as an upload destination. Set to False to disable uploads even when credentials are configured.",
+    )
+    evernote_auth_token: Optional[str] = None
+    evernote_sandbox: bool = False
+    evernote_notebook_guid: Optional[str] = None
+    evernote_default_tags: Optional[str] = None
+    evernote_include_metadata: bool = True
+
     azure_ai_key: str
     azure_region: str
     azure_endpoint: str
@@ -244,6 +255,10 @@ class Settings(BaseSettings):
             "Useful for admin-configured non-standard durations."
         ),
     )
+    qr_login_enabled: bool = Field(
+        default=True,
+        description="Enable QR code-based login for mobile device authentication (default: True).",
+    )
     qr_login_challenge_ttl_seconds: int = Field(
         default=120,
         description="Time-to-live in seconds for QR login challenges (default: 2 minutes).",

app/main.py

@@ -189,6 +189,18 @@ async def lifespan(app: FastAPI):
     finally:
         db.close()
 
+    # Re-register OAuth / social-login providers now that DB settings are
+    # loaded.  auth.py runs its initial registration at import time (before
+    # the lifespan runs), so providers that are only configured in the
+    # database would not be registered yet.  Calling refresh here ensures
+    # they are active immediately on startup without any manual restart.
+    try:
+        from app.auth import refresh_social_providers
+
+        refresh_social_providers()
+    except Exception as e:
+        logging.warning(f"Could not refresh social login providers on startup: {e}")
+
     # Initialize Sentry after DB settings are loaded so that values configured
     # via the database UI (e.g. SENTRY_DSN) are respected in addition to env vars.
     init_sentry()
@@ -282,10 +294,16 @@ async def lifespan(app: FastAPI):
     yield
 
     # Shutdown: Cleanup tasks
-    logging.info("Application shutting down")
+    try:
+        logging.info("Application shutting down")
+    except Exception:
+        _startup_logger.exception("Error during shutdown logging")
 
     # Send shutdown notification
-    notify_shutdown()
+    try:
+        notify_shutdown()
+    except Exception:
+        _startup_logger.exception("Error sending shutdown notification")
 
 
 app = FastAPI(
@@ -412,15 +430,13 @@ async def http_exception_handler(request: Request, exc: HTTPException):
     # For frontend routes, return appropriate HTML templates
     # Handle 404 errors with a custom template
     if exc.status_code == 404:
-        return _error_templates.TemplateResponse(
+        return _error_templates.TemplateResponse(request, "404.html", status_code=status.HTTP_404_NOT_FOUND)
-            "404.html", {"request": request}, status_code=status.HTTP_404_NOT_FOUND
-        )
 
     # For other HTTP errors, we could create specific templates or use a generic one
     # For now, return a simple error page
     return _error_templates.TemplateResponse(
+        request,
         "404.html",  # Reuse 404 template for other errors, or create a generic error template
-        {"request": request},
         status_code=exc.status_code,
     )
 
@@ -440,8 +456,9 @@ async def custom_500_handler(request: Request, exc: Exception):
 
     # Serve the 500 template for non-API routes
     return _error_templates.TemplateResponse(
+        request,
         "500.html",
-        {"request": request, "exc": exc},
+        context={"exc": exc},
         status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
     )
 

app/tasks/convert_to_pdf.py

@@ -205,7 +205,7 @@ def convert_to_pdf(
         ".pdf",  # PDF (already in PDF format but can be processed)
     }
 
-    IMAGE_EXTENSIONS = {".jpg", ".jpeg", ".png", ".gif", ".bmp", ".tiff", ".tif", ".webp", ".svg", ".heic", ".heif"}
+    IMAGE_EXTENSIONS = {".jpg", ".jpeg", ".png", ".gif", ".bmp", ".tiff", ".tif", ".webp", ".svg"}
 
     HTML_EXTENSIONS = {".html", ".htm"}
 

app/tasks/convert_to_pdfa.py

@@ -78,7 +78,7 @@ def _convert_pdf_to_pdfa(input_path: str, output_path: str, pdfa_format: str = "
         output_type,
         "--quiet",
         "--invalidate-digital-signatures",
-        "--",
+        "--",  # end-of-options separator: prevents file paths from being interpreted as options
         input_path,
         output_path,
     ]

app/tasks/extract_metadata_with_gpt.py

@@ -76,7 +76,7 @@ def extract_metadata_with_gpt(self, filename: str, cleaned_text: str, file_id: i
         "Your task is to analyze the given text and return a well-structured JSON object.\n\n"
         "Extract and return the following fields:\n"
         "1. **filename**: Machine-readable filename "
-        "(YYYY-MM-DD_DescriptiveTitle, use only letters, numbers, spaces, dashes, periods, and underscores).\n"
+        "(YYYY-MM-DD_DescriptiveTitle, use only letters, numbers, periods, and underscores).\n"
         '2. **empfaenger**: The recipient, or "Unknown" if not found.\n'
         '3. **absender**: The sender, or "Unknown" if not found.\n'
         "4. **correspondent**: The entity or company that issued the document "

app/tasks/imap_tasks.py

@@ -18,6 +18,7 @@ from app.utils.allowed_types import (
     DEFAULT_CATEGORIES,
     get_allowed_types_for_categories,
 )
+from app.utils.network import is_private_ip
 
 # Database session for per-user IMAP accounts (imported lazily to avoid circular imports)
 _db_session_factory = None
@@ -405,6 +406,11 @@ def pull_inbox(
     )
     processed_emails = load_processed_emails()
 
+    # Security: Prevent SSRF by blocking connections to internal IPs
+    if is_private_ip(host):
+        logger.warning("SSRF blocked: Attempt to pull mailbox from private IP %s", host)
+        return
+
     try:
         mail = imaplib.IMAP4_SSL(host, port) if use_ssl else imaplib.IMAP4(host, port)
         mail.login(username, password)

app/tasks/send_to_all.py

@@ -10,6 +10,7 @@ from app.models import FileRecord, IntegrationDirection, UserIntegration
 from app.tasks.retry_config import BaseTaskWithRetry
 from app.tasks.upload_to_dropbox import upload_to_dropbox
 from app.tasks.upload_to_email import upload_to_email
+from app.tasks.upload_to_evernote import upload_to_evernote
 from app.tasks.upload_to_ftp import upload_to_ftp
 from app.tasks.upload_to_google_drive import upload_to_google_drive
 from app.tasks.upload_to_icloud import upload_to_icloud
@@ -100,6 +101,11 @@ def _should_upload_to_email():
     )
 
 
+def _should_upload_to_evernote():
+    token = getattr(settings, "evernote_auth_token", None)
+    return bool(getattr(settings, "evernote_enabled", True) and isinstance(token, str) and token.strip())
+
+
 def _should_upload_to_onedrive():
     return bool(
         getattr(settings, "onedrive_enabled", True)
@@ -151,6 +157,7 @@ def get_configured_services_from_validator():
         "FTP Storage": "ftp",
         "SFTP Storage": "sftp",
         "Email": "email",
+        "Evernote": "evernote",
         "OneDrive": "onedrive",
         "S3 Storage": "s3",
         "SharePoint": "sharepoint",
@@ -254,6 +261,11 @@ def send_to_all_destinations(self, file_path: str, use_validator=True, file_id:
             "should_upload": _should_upload_to_email,
             "upload_func": upload_to_email,
         },
+        {
+            "name": "evernote",
+            "should_upload": _should_upload_to_evernote,
+            "upload_func": upload_to_evernote,
+        },
         {
             "name": "onedrive",
             "should_upload": _should_upload_to_onedrive,

app/tasks/upload_to_evernote.py

@@ -0,0 +1,242 @@
+#!/usr/bin/env python3
+
+import hashlib
+import json
+import logging
+import mimetypes
+import os
+from html import escape
+from typing import Any
+
+from app.celery_app import celery
+from app.config import settings
+from app.tasks.retry_config import UploadTaskWithRetry
+from app.utils import log_task_progress
+
+logger = logging.getLogger(__name__)
+
+_UNKNOWN_PLACEHOLDERS = {"", "Unknown", "unknown", "N/A", "n/a", "None", "none", "null"}
+_MAX_EVERNOTE_TITLE_LENGTH = 255
+
+
+def _get_evernote_sdk():
+    """Import the Evernote SDK lazily so the missing dependency error is actionable."""
+    try:
+        from evernote.edam.notestore import NoteStore
+        from evernote.edam.type import ttypes as Types
+        from evernote.edam.userstore import UserStore
+        from thrift.protocol import TBinaryProtocol
+        from thrift.transport import THttpClient
+    except ImportError as exc:
+        raise RuntimeError("Evernote upload requires the evernote3 package. Install requirements.txt again.") from exc
+    return NoteStore, Types, UserStore, TBinaryProtocol, THttpClient
+
+
+def _build_thrift_client(client_cls, url: str, binary_protocol, http_transport):
+    transport = http_transport.THttpClient(url)
+    protocol = binary_protocol.TBinaryProtocol(transport)
+    return client_cls(protocol)
+
+
+def _get_note_store(auth_token: str):
+    NoteStore, Types, UserStore, TBinaryProtocol, THttpClient = _get_evernote_sdk()
+
+    base_url = (
+        "https://sandbox.evernote.com" if getattr(settings, "evernote_sandbox", False) else "https://www.evernote.com"
+    )
+    user_store = _build_thrift_client(UserStore.Client, f"{base_url}/edam/user", TBinaryProtocol, THttpClient)
+    user = user_store.getUser(auth_token)
+    shard_id = getattr(user, "shardId", None)
+    if not shard_id:
+        raise RuntimeError("Evernote user response did not include a shard ID")
+
+    note_store_url = f"{base_url}/shard/{shard_id}/notestore"
+    note_store = _build_thrift_client(NoteStore.Client, note_store_url, TBinaryProtocol, THttpClient)
+    return note_store, Types
+
+
+def _load_metadata(file_path: str) -> dict[str, Any]:
+    """Load extracted DocuElevate metadata from the companion JSON file, when present."""
+    json_path = os.path.splitext(file_path)[0] + ".json"
+    if not os.path.exists(json_path):
+        return {}
+
+    try:
+        with open(json_path, "r", encoding="utf-8") as metadata_file:
+            data = json.load(metadata_file)
+    except Exception as exc:  # noqa: BLE001
+        logger.warning("Failed to load Evernote metadata from %s: %s", json_path, exc)
+        return {}
+
+    return data if isinstance(data, dict) else {}
+
+
+def _normalize_metadata_value(value: Any) -> str:
+    if value is None:
+        return ""
+    if isinstance(value, (list, tuple, set)):
+        normalized = ", ".join(str(item) for item in value if item is not None)
+    elif isinstance(value, dict):
+        normalized = json.dumps(value, ensure_ascii=False, sort_keys=True)
+    else:
+        normalized = str(value)
+
+    normalized = normalized.strip()
+    return "" if normalized in _UNKNOWN_PLACEHOLDERS else normalized
+
+
+def _metadata_rows(metadata: dict[str, Any]) -> list[tuple[str, str]]:
+    rows = []
+    for key in sorted(metadata):
+        value = _normalize_metadata_value(metadata[key])
+        if value:
+            rows.append((key, value))
+    return rows
+
+
+def _extract_tags(metadata: dict[str, Any]) -> list[str]:
+    tags: list[str] = []
+
+    def add_tag(value: Any) -> None:
+        normalized = _normalize_metadata_value(value)
+        if normalized and normalized not in tags:
+            tags.append(normalized)
+
+    default_tags = getattr(settings, "evernote_default_tags", None)
+    if default_tags:
+        for tag in str(default_tags).split(","):
+            add_tag(tag)
+
+    metadata_tags = metadata.get("tags")
+    if isinstance(metadata_tags, str):
+        for tag in metadata_tags.split(","):
+            add_tag(tag)
+    elif isinstance(metadata_tags, (list, tuple, set)):
+        for tag in metadata_tags:
+            add_tag(tag)
+
+    return tags
+
+
+def _note_title(file_path: str, metadata: dict[str, Any]) -> str:
+    title = (
+        _normalize_metadata_value(metadata.get("title"))
+        or _normalize_metadata_value(metadata.get("filename"))
+        or os.path.basename(file_path)
+    )
+    return title[:_MAX_EVERNOTE_TITLE_LENGTH]
+
+
+def _build_enml(metadata: dict[str, Any], resource_hash: str, resource_mime: str, include_metadata: bool) -> str:
+    body_parts = ['<?xml version="1.0" encoding="UTF-8"?>']
+    body_parts.append('<!DOCTYPE en-note SYSTEM "http://xml.evernote.com/pub/enml2.dtd">')
+    body_parts.append("<en-note>")
+
+    if include_metadata:
+        rows = _metadata_rows(metadata)
+        if rows:
+            body_parts.append("<div><b>DocuElevate metadata</b></div>")
+            for key, value in rows:
+                body_parts.append(f"<div><b>{escape(key)}:</b> {escape(value)}</div>")
+            body_parts.append("<br/>")
+
+    body_parts.append(f'<en-media type="{escape(resource_mime)}" hash="{resource_hash}"/>')
+    body_parts.append("</en-note>")
+    return "".join(body_parts)
+
+
+def _create_evernote_note(file_path: str, metadata: dict[str, Any], task_id: str):
+    auth_token = getattr(settings, "evernote_auth_token", None)
+    if not auth_token:
+        raise ValueError("Evernote auth token is not configured (EVERNOTE_AUTH_TOKEN)")
+
+    note_store, Types = _get_note_store(auth_token)
+
+    filename = os.path.basename(file_path)
+    with open(file_path, "rb") as pdf_file:
+        resource_body = pdf_file.read()
+
+    body_hash = hashlib.md5(resource_body).digest()  # noqa: S324 - Evernote API requires MD5 resource hashes.
+    body_hash_hex = hashlib.md5(resource_body).hexdigest()  # noqa: S324 - Evernote ENML references MD5 hashes.
+    resource_mime = mimetypes.guess_type(filename)[0] or "application/pdf"
+
+    data = Types.Data()
+    data.size = len(resource_body)
+    data.bodyHash = body_hash
+    data.body = resource_body
+
+    resource = Types.Resource()
+    resource.mime = resource_mime
+    resource.data = data
+    resource.attributes = Types.ResourceAttributes(fileName=filename)
+
+    note = Types.Note()
+    note.title = _note_title(file_path, metadata)
+    note.content = _build_enml(
+        metadata,
+        body_hash_hex,
+        resource_mime,
+        include_metadata=getattr(settings, "evernote_include_metadata", True),
+    )
+    note.resources = [resource]
+
+    notebook_guid = getattr(settings, "evernote_notebook_guid", None)
+    if notebook_guid:
+        note.notebookGuid = notebook_guid
+
+    tag_names = _extract_tags(metadata)
+    if tag_names:
+        note.tagNames = tag_names
+
+    created_note = note_store.createNote(auth_token, note)
+
+    logger.info("[%s] Created Evernote note %s for %s", task_id, getattr(created_note, "guid", None), file_path)
+    return created_note
+
+
+@celery.task(base=UploadTaskWithRetry, bind=True)
+def upload_to_evernote(self, file_path: str, file_id: int = None):
+    """
+    Upload a document to Evernote by creating a note with metadata and a PDF attachment.
+
+    Args:
+        file_path: Path to the PDF file to upload
+        file_id: Optional file ID to associate with logs
+    """
+    task_id = self.request.id
+    filename = os.path.basename(file_path)
+    logger.info("[%s] Starting Evernote upload: %s", task_id, file_path)
+    log_task_progress(
+        task_id, "upload_to_evernote", "in_progress", f"Uploading to Evernote: {filename}", file_id=file_id
+    )
+
+    if not os.path.exists(file_path):
+        error_msg = f"File not found: {file_path}"
+        logger.error("[%s] %s", task_id, error_msg)
+        log_task_progress(task_id, "upload_to_evernote", "failure", error_msg, file_id=file_id)
+        raise FileNotFoundError(error_msg)
+
+    if not getattr(settings, "evernote_auth_token", None):
+        error_msg = "Evernote auth token is not configured (EVERNOTE_AUTH_TOKEN)"
+        logger.error("[%s] %s", task_id, error_msg)
+        log_task_progress(task_id, "upload_to_evernote", "failure", error_msg, file_id=file_id)
+        raise ValueError(error_msg)
+
+    try:
+        metadata = _load_metadata(file_path)
+        created_note = _create_evernote_note(file_path, metadata, task_id)
+    except Exception as exc:
+        error_msg = f"Failed to upload to Evernote: {exc}"
+        logger.error("[%s] %s", task_id, error_msg)
+        log_task_progress(task_id, "upload_to_evernote", "failure", error_msg, file_id=file_id)
+        raise
+
+    note_guid = getattr(created_note, "guid", None)
+    log_task_progress(task_id, "upload_to_evernote", "success", f"Uploaded to Evernote: {note_guid}", file_id=file_id)
+    return {
+        "status": "Completed",
+        "file_path": file_path,
+        "evernote_note_guid": note_guid,
+        "evernote_title": getattr(created_note, "title", None),
+        "evernote_notebook_guid": getattr(created_note, "notebookGuid", None),
+    }

app/tasks/upload_to_user_integration.py

@@ -555,9 +555,8 @@ def _upload_rclone(file_path: str, cfg: dict[str, Any], creds: dict[str, Any], t
     dest = dest.replace("//", "/")
 
     try:
-        # SECURITY: Separate options from positional arguments using -- to prevent command injection
         result = subprocess.run(  # nosec B603  # noqa: S603 S607
-            ["rclone", "copyto", f"--config={conf_path}", "--", file_path, dest],  # noqa: S603 S607
+            ["rclone", "copyto", f"--config={conf_path}", file_path, dest],  # noqa: S603 S607
             capture_output=True,
             text=True,
             timeout=300,

app/utils/config_validator/providers.py

@@ -174,6 +174,21 @@ def get_provider_status() -> dict[str, dict[str, object]]:
         },
     }
 
+    providers["Evernote"] = {
+        "name": "Evernote",
+        "icon": "fa-brands fa-evernote",
+        "configured": bool(getattr(settings, "evernote_auth_token", None)),
+        "enabled": getattr(settings, "evernote_enabled", True),
+        "description": "Create Evernote notes with document metadata and PDF attachments",
+        "details": {
+            "auth_token": mask_sensitive_value(getattr(settings, "evernote_auth_token", None)),
+            "sandbox": getattr(settings, "evernote_sandbox", False),
+            "notebook_guid": getattr(settings, "evernote_notebook_guid", "Not set"),
+            "default_tags": getattr(settings, "evernote_default_tags", "Not set"),
+            "include_metadata": getattr(settings, "evernote_include_metadata", True),
+        },
+    }
+
     # Add FTP configuration to providers
     providers["FTP Storage"] = {
         "name": "FTP Storage",

app/utils/config_validator/validators.py

@@ -145,6 +145,12 @@ def validate_storage_configs() -> dict[str, list[str]]:
         email_issues.append("DEST_EMAIL_DEFAULT_RECIPIENT is not configured")
     issues["email"] = email_issues
 
+    # Validate Evernote
+    evernote_issues = []
+    if not getattr(settings, "evernote_auth_token", None):
+        evernote_issues.append("EVERNOTE_AUTH_TOKEN is not configured")
+    issues["evernote"] = evernote_issues
+
     # Validate S3
     s3_issues = []
     if not getattr(settings, "s3_bucket_name", None):

app/utils/db_migrate.py

@@ -15,7 +15,7 @@ import logging
 import re
 from typing import Any
 
-from sqlalchemy import MetaData, create_engine, inspect, text
+from sqlalchemy import MetaData, create_engine, func, inspect, select, table
 from sqlalchemy.engine import Engine
 from sqlalchemy.engine.url import make_url
 from sqlalchemy.orm import sessionmaker
@@ -89,8 +89,9 @@ def preview_migration(source_url: str) -> dict[str, Any]:
                     logger.warning(f"Skipping table with invalid name format: {table_name}")
                     continue
                 # table_name is safe — sourced from inspect().get_table_names(), not user input
-                quoted_table = conn.dialect.identifier_preparer.quote(table_name)
+                t = table(table_name)
-                row = conn.execute(text(f"SELECT COUNT(*) FROM {quoted_table}")).fetchone()  # noqa: S608
+                query = select(func.count()).select_from(t)
+                row = conn.execute(query).fetchone()
                 count = row[0] if row else 0
                 result.append({"name": table_name, "row_count": count})
                 total += count

app/utils/env_utils.py

@@ -1,11 +1,10 @@
 import logging
 import os
-from typing import Dict
 
 logger = logging.getLogger(__name__)
 
 
-def update_env_file(settings_to_update: Dict[str, str]) -> bool:
+def update_env_file(settings_to_update: dict[str, str]) -> bool:
     """
     Updates the .env file with the given settings (best-effort).
     Creates or modifies existing keys.

app/utils/file_operations.py

@@ -7,8 +7,19 @@ def hash_file(filepath: str | Path, chunk_size: int = 65536) -> str:
     Returns the SHA-256 hash of the file at 'filepath'.
     Reads the file in chunks to handle large files efficiently.
     """
+    from app.config import settings
+
+    filepath_obj = Path(filepath).resolve()
+    workdir_obj = Path(settings.workdir).resolve()
+
+    # Security check: Ensure the resolved path is strictly within the allowed workdir
+    try:
+        filepath_obj.relative_to(workdir_obj)
+    except ValueError:
+        raise FileNotFoundError(f"Access denied: path traversal attempt or file outside workdir '{filepath}'")
+
     sha256 = hashlib.sha256()
-    with open(filepath, "rb") as f:
+    with open(filepath_obj, "rb") as f:
         while True:
             data = f.read(chunk_size)
             if not data:

app/utils/network.py

@@ -1,6 +1,7 @@
 import ipaddress
 import logging
 import socket
+from urllib.parse import urlsplit, urlunsplit
 
 logger = logging.getLogger(__name__)
 
@@ -27,8 +28,33 @@ def is_private_ip(hostname: str) -> bool:
                     return True
             return False
         except (socket.gaierror, socket.error):
-            # Cannot resolve - allow for testing/development
+            # Cannot resolve.
-            # In production, DNS should work properly
+            # Fail securely: block unresolved domains to prevent DNS rebinding
-            # Log this for debugging
+            # and SSRF bypasses via unresolvable addresses.
-            logger.warning(f"Could not resolve hostname: {hostname}")
+            logger.warning(f"Could not resolve hostname (blocking securely): {hostname}")
-            return False  # Changed from True to False to allow external domains in tests
+            return True
+
+
+def join_url(base: str, *parts: str) -> str:
+    """
+    Safely join a base URL with one or more path parts.
+
+    Uses urllib.parse to correctly handle scheme/netloc/query/fragment so that
+    only the path component is modified.  Leading and trailing slashes are
+    stripped from each part before joining, preventing double-slash sequences
+    at segment boundaries without touching the scheme separator or query string.
+
+    Examples:
+        join_url("https://example.com/dav/", "/remote/", "file.pdf")
+        -> "https://example.com/dav/remote/file.pdf"
+    """
+    parsed = urlsplit(base)
+    # Strip each part once and filter out empty segments; use walrus operator
+    # to avoid calling strip twice per iteration.
+    stripped_parts = [s for p in parts if (s := p.strip("/"))]
+    base_path = parsed.path.rstrip("/")
+    new_path = base_path + "/" + "/".join(stripped_parts) if stripped_parts else base_path
+    # Ensure path is non-empty so the reconstructed URL is valid.
+    if not new_path:
+        new_path = "/"
+    return urlunsplit((parsed.scheme, parsed.netloc, new_path, parsed.query, parsed.fragment))

app/utils/settings_service.py

@@ -206,6 +206,14 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": True,
     },
+    "qr_login_enabled": {
+        "category": "Authentication",
+        "description": "Enable QR code-based login for mobile device authentication.",
+        "type": "boolean",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
     "qr_login_challenge_ttl_seconds": {
         "category": "Authentication",
         "description": "Time-to-live in seconds for QR login challenges (default 120).",
@@ -1081,6 +1089,55 @@ SETTING_METADATA = {
         "required": False,
         "restart_required": False,
     },
+    # Storage Providers - Evernote
+    "evernote_enabled": {
+        "category": "Storage Providers",
+        "description": "Enable Evernote as an upload destination. When disabled, no documents will be sent to Evernote even if credentials are configured.",
+        "type": "boolean",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "evernote_auth_token": {
+        "category": "Storage Providers",
+        "description": "Evernote developer token for note creation",
+        "type": "string",
+        "sensitive": True,
+        "required": False,
+        "restart_required": False,
+    },
+    "evernote_sandbox": {
+        "category": "Storage Providers",
+        "description": "Use the Evernote sandbox environment instead of production",
+        "type": "boolean",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "evernote_notebook_guid": {
+        "category": "Storage Providers",
+        "description": "Optional Evernote notebook GUID for uploaded notes",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "evernote_default_tags": {
+        "category": "Storage Providers",
+        "description": "Comma-separated Evernote tags to apply to uploaded notes",
+        "type": "string",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
+    "evernote_include_metadata": {
+        "category": "Storage Providers",
+        "description": "Include extracted document metadata in Evernote note content",
+        "type": "boolean",
+        "sensitive": False,
+        "required": False,
+        "restart_required": False,
+    },
     # Storage Providers - Google Drive
     "google_drive_enabled": {
         "category": "Storage Providers",

app/utils/settings_sync.py

@@ -71,6 +71,16 @@ def notify_settings_updated() -> None:
     except Exception as exc:
         logger.warning(f"Could not reload in-process settings: {exc}")
 
+    # Re-register OAuth / social-login providers so that any provider whose
+    # credentials were just saved (or updated) in the database is active
+    # immediately on the login page — no restart required.
+    try:
+        from app.auth import refresh_social_providers
+
+        refresh_social_providers()
+    except Exception as exc:
+        logger.warning(f"Could not refresh social login providers after settings update: {exc}")
+
     # Re-check OCR language availability in the background whenever settings
     # are updated.  This ensures that if a user changes tesseract_language or
     # easyocr_languages via the UI, the new language data is downloaded without

app/utils/subscription.py

@@ -29,7 +29,7 @@ At average usage (~40 % of quota) margins improve to 55-65 % after tax.
 from __future__ import annotations
 
 import logging
-from datetime import date, datetime, timezone
+from datetime import date, datetime, time, timedelta, timezone
 from typing import Any
 
 from sqlalchemy import func
@@ -317,6 +317,20 @@ def _today_utc() -> date:
     return datetime.now(timezone.utc).date()
 
 
+def _day_bounds_utc(day: date) -> tuple[datetime, datetime]:
+    start = datetime.combine(day, time.min, tzinfo=timezone.utc)
+    return start, start + timedelta(days=1)
+
+
+def _month_bounds_utc(day: date) -> tuple[datetime, datetime]:
+    start = datetime.combine(day.replace(day=1), time.min, tzinfo=timezone.utc)
+    if start.month == 12:
+        end = start.replace(year=start.year + 1, month=1)
+    else:
+        end = start.replace(month=start.month + 1)
+    return start, end
+
+
 def _scalar_count(query: Any) -> int:
     """Execute a count query and return an int, defaulting to 0 for NULL."""
     return query.scalar() or 0
@@ -335,12 +349,13 @@ def get_today_file_count(db: Session, owner_id: str) -> int:
     """Files processed by this user today (UTC, not counting duplicates)."""
     from app.models import FileRecord
 
-    today = _today_utc()
+    day_start, day_end = _day_bounds_utc(_today_utc())
     return _scalar_count(
         db.query(func.count(FileRecord.id)).filter(
             FileRecord.owner_id == owner_id,
             FileRecord.is_duplicate.is_(False),
-            func.date(FileRecord.created_at) == today,
+            FileRecord.created_at >= day_start,
+            FileRecord.created_at < day_end,
         )
     )
 
@@ -349,12 +364,13 @@ def get_month_file_count(db: Session, owner_id: str) -> int:
     """Files processed by this user this calendar month (UTC, not counting duplicates)."""
     from app.models import FileRecord
 
-    today = _today_utc()
+    month_start, month_end = _month_bounds_utc(_today_utc())
     return _scalar_count(
         db.query(func.count(FileRecord.id)).filter(
             FileRecord.owner_id == owner_id,
             FileRecord.is_duplicate.is_(False),
-            func.strftime("%Y-%m", FileRecord.created_at) == today.strftime("%Y-%m"),
+            FileRecord.created_at >= month_start,
+            FileRecord.created_at < month_end,
         )
     )
 

app/utils/user_notification.py

@@ -12,11 +12,13 @@ import smtplib
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from typing import Any
+from urllib.parse import urlparse
 
 import httpx
 
 from app.database import SessionLocal
 from app.models import InAppNotification, UserNotificationPreference, UserNotificationTarget
+from app.utils.network import is_private_ip
 
 logger = logging.getLogger(__name__)
 
@@ -28,6 +30,11 @@ USER_EVENT_LABELS: dict[str, str] = {
     EVENT_DOCUMENT_PROCESSED: "Document Processed",
     EVENT_DOCUMENT_FAILED: "Document Processing Failed",
 }
+METADATA_ENDPOINTS = {
+    "169.254.169.254",
+    "169.254.169.253",
+    "metadata.google.internal",
+}
 
 
 def create_in_app_notification(
@@ -128,6 +135,20 @@ def _send_webhook_notification(target_config: dict[str, Any], event_type: str, t
             logger.warning("Webhook notification target missing url")
             return False
 
+        parsed_url = urlparse(url)
+        if parsed_url.scheme not in {"http", "https"}:
+            logger.warning("Webhook notification to %s blocked: invalid scheme %s", url, parsed_url.scheme)
+            return False
+
+        hostname = parsed_url.hostname
+        if not hostname:
+            logger.warning("Webhook notification to %s blocked: missing hostname", url)
+            return False
+
+        if hostname in METADATA_ENDPOINTS or is_private_ip(hostname):
+            logger.warning("Webhook notification to %s blocked: private or metadata endpoint", url)
+            return False
+
         payload = {
             "event": event_type,
             "title": title,

app/utils/webhook.py

@@ -18,11 +18,13 @@ import json
 import logging
 import time
 from typing import Any
+from urllib.parse import urlparse
 
 import requests
 
 from app.database import SessionLocal
 from app.models import WebhookConfig
+from app.utils.network import is_private_ip
 
 logger = logging.getLogger(__name__)
 
@@ -40,6 +42,11 @@ VALID_EVENTS: frozenset[str] = frozenset(
 
 #: Timeout (seconds) for outgoing webhook HTTP requests.
 WEBHOOK_TIMEOUT = 10
+METADATA_ENDPOINTS = {
+    "169.254.169.254",
+    "169.254.169.253",
+    "metadata.google.internal",
+}
 
 
 def compute_signature(payload_bytes: bytes, secret: str) -> str:
@@ -67,6 +74,20 @@ def deliver_webhook(url: str, payload: dict[str, Any], secret: str | None = None
     Returns:
         ``True`` when the remote server responds with a 2xx status.
     """
+    parsed_url = urlparse(url)
+    if parsed_url.scheme not in {"http", "https"}:
+        logger.warning("Webhook to %s blocked: invalid scheme %s", url, parsed_url.scheme)
+        return False
+
+    hostname = parsed_url.hostname
+    if not hostname:
+        logger.warning("Webhook to %s blocked: missing hostname", url)
+        return False
+
+    if hostname in METADATA_ENDPOINTS or is_private_ip(hostname):
+        logger.warning("Webhook to %s blocked: private or metadata endpoint", url)
+        return False
+
     body = json.dumps(payload, default=str, sort_keys=True)
     body_bytes = body.encode("utf-8")
 

app/views/base.py

@@ -162,12 +162,36 @@ def _inject_global_context(ctx: dict) -> None:
 
 
 def template_response_with_version(*args, **kwargs):
-    """Wrapper for TemplateResponse to include version and CSRF token in all templates"""
+    """Wrapper for TemplateResponse to include version and CSRF token in all templates.
-    # If context dict is provided, add version to it
+
-    if len(args) >= 2 and isinstance(args[1], dict):
+    Handles both old-style and new-style Starlette TemplateResponse calls:
-        _inject_global_context(args[1])
+      - Old-style (Starlette <1.0): TemplateResponse(name, {"request": req, ...}, ...)
-    elif "context" in kwargs and isinstance(kwargs["context"], dict):
+      - New-style (Starlette 1.0+): TemplateResponse(request, name, context={...}, ...)
+    """
+    if len(args) >= 1 and isinstance(args[0], str):
+        # Old-style call: first positional arg is the template name (string).
+        # Convert to new-style: (request, name, context=..., ...)
+        name = args[0]
+        if len(args) >= 2 and isinstance(args[1], dict):
+            context = args[1]
+            # Old-style may have status_code as 3rd positional arg
+            if len(args) >= 3 and "status_code" not in kwargs:
+                kwargs["status_code"] = args[2]
+        else:
+            context = kwargs.pop("context", {})
+        request_obj = context.pop("request", None)
+        if request_obj is not None:
+            context["request"] = request_obj
+        _inject_global_context(context)
+        if request_obj is not None:
+            return original_template_response(request_obj, name, context=context, **kwargs)
+        return original_template_response(name, context=context, **kwargs)
+
+    # New-style call: (request, name, context=..., ...)
+    if "context" in kwargs and isinstance(kwargs["context"], dict):
         _inject_global_context(kwargs["context"])
+    elif len(args) >= 3 and isinstance(args[2], dict):
+        _inject_global_context(args[2])
     return original_template_response(*args, **kwargs)
 
 

app/views/files.py

@@ -19,6 +19,43 @@ router = APIRouter()
 _FILE_NOT_FOUND = "File not found"
 
 
+def _resolve_owner_context(request: Request, file_record, db: Session) -> dict:
+    """Return owner display info and the current user's effective role.
+
+    Returns a dict with:
+    - ``current_user_role``: one of "owner" / "editor" / "viewer" / None
+    - ``owner_display``: human-readable owner string (display_name or user_id)
+    - ``multi_user_enabled``: whether multi-user mode is active
+    """
+    from app.config import settings
+    from app.models import UserProfile
+    from app.utils.user_scope import get_current_owner_id, get_file_role
+
+    multi_user_enabled = settings.multi_user_enabled
+
+    current_owner_id = get_current_owner_id(request)
+    user_session = request.session.get("user")
+    is_admin = isinstance(user_session, dict) and bool(user_session.get("is_admin"))
+
+    if is_admin:
+        current_user_role: str | None = "owner"
+    else:
+        current_user_role = get_file_role(file_record, current_owner_id, db)
+
+    # Build a human-readable owner label
+    if file_record.owner_id:
+        profile = db.query(UserProfile).filter(UserProfile.user_id == file_record.owner_id).first()
+        owner_display: str | None = profile.display_name if profile and profile.display_name else file_record.owner_id
+    else:
+        owner_display = None  # No owner (unowned)
+
+    return {
+        "current_user_role": current_user_role,
+        "owner_display": owner_display,
+        "multi_user_enabled": multi_user_enabled,
+    }
+
+
 @router.get("/files")
 @require_login
 def files_page(
@@ -268,6 +305,7 @@ def file_summary_page(request: Request, file_id: int, db: Session = Depends(get_
             step_summary = None
 
         pipeline_info = _resolve_pipeline(db, file_record)
+        owner_ctx = _resolve_owner_context(request, file_record, db)
 
         return templates.TemplateResponse(
             "file_summary.html",
@@ -279,6 +317,7 @@ def file_summary_page(request: Request, file_id: int, db: Session = Depends(get_
                 "processed_file_exists": processed_file_exists,
                 "step_summary": step_summary,
                 "pipeline_info": pipeline_info,
+                **owner_ctx,
             },
         )
     except Exception as e:
@@ -353,6 +392,7 @@ def file_view_page(request: Request, file_id: int, db: Session = Depends(get_db)
 
         # Resolve the pipeline assigned to this file (explicit or system default)
         pipeline_info = _resolve_pipeline(db, file_record)
+        owner_ctx = _resolve_owner_context(request, file_record, db)
 
         return templates.TemplateResponse(
             "file_view.html",
@@ -364,6 +404,7 @@ def file_view_page(request: Request, file_id: int, db: Session = Depends(get_db)
                 "processed_file_exists": processed_file_exists,
                 "step_summary": step_summary,
                 "pipeline_info": pipeline_info,
+                **owner_ctx,
             },
         )
     except Exception as e:
@@ -497,17 +538,8 @@ def file_annotations_page(request: Request, file_id: int, db: Session = Depends(
         mime = file_record.mime_type or ""
         is_pdf = mime == "application/pdf" or (file_record.original_filename or "").lower().endswith(".pdf")
 
-        # Determine the current user's role on this file
+        # Determine the current user's role on this file (and owner display info)
-        from app.utils.user_scope import get_current_owner_id, get_file_role
+        owner_ctx = _resolve_owner_context(request, file_record, db)
-
-        current_owner_id = get_current_owner_id(request)
-        user_session = request.session.get("user")
-        is_admin = isinstance(user_session, dict) and bool(user_session.get("is_admin"))
-        if is_admin:
-            current_user_role: str | None = "owner"
-        else:
-            current_user_role = get_file_role(file_record, current_owner_id, db)
-            # None means no access — the template will not show owner-only UI
 
         return templates.TemplateResponse(
             "file_annotations.html",
@@ -517,7 +549,7 @@ def file_annotations_page(request: Request, file_id: int, db: Session = Depends(
                 "original_file_exists": original_file_exists,
                 "processed_file_exists": processed_file_exists,
                 "is_pdf": is_pdf,
-                "current_user_role": current_user_role,
+                **owner_ctx,
             },
         )
     except Exception as e:
@@ -685,6 +717,7 @@ def _compute_processing_flow(logs, pipeline_steps=None):
         "upload_to_ftp": "FTP Storage",
         "upload_to_sftp": "SFTP Storage",
         "upload_to_email": "Email",
+        "upload_to_evernote": "Evernote",
         "queue_dropbox": "Dropbox",
         "queue_nextcloud": "Nextcloud",
         "queue_paperless": "Paperless-ngx",
@@ -695,6 +728,7 @@ def _compute_processing_flow(logs, pipeline_steps=None):
         "queue_ftp": "FTP Storage",
         "queue_sftp": "SFTP Storage",
         "queue_email": "Email",
+        "queue_evernote": "Evernote",
     }
 
     # Create a map of step names to their log entries

app/views/general.py

@@ -2,7 +2,7 @@
 General routes for the application homepage and basic pages.
 """
 
-from datetime import date, datetime, timezone
+from datetime import date, datetime, time, timedelta, timezone
 from pathlib import Path
 
 from fastapi import Depends, HTTPException, Request
@@ -64,17 +64,27 @@ async def serve_index(request: Request, db: Session = Depends(get_db)):
 
     user = request.session.get("user") or {}
     is_admin = user.get("is_admin", False)
+    day_start = datetime.combine(today, time.min, tzinfo=timezone.utc)
+    day_end = day_start + timedelta(days=1)
+    month_start = day_start.replace(day=1)
+    if month_start.month == 12:
+        month_end = month_start.replace(year=month_start.year + 1, month=1)
+    else:
+        month_end = month_start.replace(month=month_start.month + 1)
 
     try:
         total_files: int = db.query(func.count(FileRecord.id)).scalar() or 0
 
         files_today: int = (
-            db.query(func.count(FileRecord.id)).filter(func.date(FileRecord.created_at) == today).scalar() or 0
+            db.query(func.count(FileRecord.id))
+            .filter(FileRecord.created_at >= day_start, FileRecord.created_at < day_end)
+            .scalar()
+            or 0
         )
 
         files_month: int = (
             db.query(func.count(FileRecord.id))
-            .filter(func.strftime("%Y-%m", FileRecord.created_at) == today.strftime("%Y-%m"))
+            .filter(FileRecord.created_at >= month_start, FileRecord.created_at < month_end)
             .scalar()
             or 0
         )

app/views/settings.py

@@ -206,8 +206,6 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
     SSO settings, and service integrations through a wizard-like interface.
     """
     try:
-        from app.auth import OAUTH_CONFIGURED, SOCIAL_PROVIDERS
-
         db_settings = get_all_settings_from_db(db)
 
         def _get_effective(key: str):
@@ -227,13 +225,14 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
         services = []
 
         # --- SSO (Authentik / OIDC) ---
+        _oidc_linked = bool(_get_effective("authentik_client_id") and _get_effective("authentik_client_secret"))
         services.append(
             {
                 "key": "oidc",
-                "name": settings.oauth_provider_name or "Single Sign-On",
+                "name": _get_effective("oauth_provider_name") or "Single Sign-On",
                 "icon": "fas fa-lock",
                 "type": "SSO",
-                "linked": OAUTH_CONFIGURED,
+                "linked": _oidc_linked,
                 "description": "OpenID Connect SSO provider",
                 "settings_keys": [
                     "authentik_client_id",
@@ -245,13 +244,23 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
         )
 
         # --- Google ---
+        _google_id = _get_effective("social_auth_google_client_id")
+        _google_secret = _get_effective("social_auth_google_client_secret")
+        if _is_truthy(_get_effective("social_auth_google_use_global_credentials")) and not (
+            _google_id and _google_secret
+        ):
+            _google_id = _google_id or _get_effective("google_drive_client_id")
+            _google_secret = _google_secret or _get_effective("google_drive_client_secret")
+        _google_linked = bool(
+            _is_truthy(_get_effective("social_auth_google_enabled")) and _google_id and _google_secret
+        )
         services.append(
             {
                 "key": "google",
                 "name": "Google",
                 "icon": "fab fa-google",
                 "type": "Sign-in authentication",
-                "linked": "google" in SOCIAL_PROVIDERS,
+                "linked": _google_linked,
                 "description": "Sign-in authentication",
                 "settings_keys": [
                     "social_auth_google_enabled",
@@ -263,13 +272,18 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
         )
 
         # --- GitHub ---
+        _github_linked = bool(
+            _is_truthy(_get_effective("social_auth_github_enabled"))
+            and _get_effective("social_auth_github_client_id")
+            and _get_effective("social_auth_github_client_secret")
+        )
         services.append(
             {
                 "key": "github",
                 "name": "GitHub",
                 "icon": "fab fa-github",
                 "type": "Sign-in authentication",
-                "linked": "github" in SOCIAL_PROVIDERS,
+                "linked": _github_linked,
                 "description": "Sign-in authentication",
                 "settings_keys": [
                     "social_auth_github_enabled",
@@ -280,13 +294,19 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
         )
 
         # --- Microsoft ---
+        _ms_id = _get_effective("social_auth_microsoft_client_id")
+        _ms_secret = _get_effective("social_auth_microsoft_client_secret")
+        if _is_truthy(_get_effective("social_auth_microsoft_use_global_credentials")) and not (_ms_id and _ms_secret):
+            _ms_id = _ms_id or _get_effective("onedrive_client_id")
+            _ms_secret = _ms_secret or _get_effective("onedrive_client_secret")
+        _microsoft_linked = bool(_is_truthy(_get_effective("social_auth_microsoft_enabled")) and _ms_id and _ms_secret)
         services.append(
             {
                 "key": "microsoft",
                 "name": "Microsoft",
                 "icon": "fab fa-microsoft",
                 "type": "Sign-in authentication",
-                "linked": "microsoft" in SOCIAL_PROVIDERS,
+                "linked": _microsoft_linked,
                 "description": "Sign-in authentication",
                 "settings_keys": [
                     "social_auth_microsoft_enabled",
@@ -299,13 +319,18 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
         )
 
         # --- Apple ---
+        _apple_linked = bool(
+            _is_truthy(_get_effective("social_auth_apple_enabled"))
+            and _get_effective("social_auth_apple_client_id")
+            and _get_effective("social_auth_apple_team_id")
+        )
         services.append(
             {
                 "key": "apple",
                 "name": "Apple",
                 "icon": "fab fa-apple",
                 "type": "Sign-in authentication",
-                "linked": "apple" in SOCIAL_PROVIDERS,
+                "linked": _apple_linked,
                 "description": "Sign-in authentication",
                 "settings_keys": [
                     "social_auth_apple_enabled",
@@ -318,13 +343,19 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
         )
 
         # --- Dropbox ---
+        _dbx_id = _get_effective("social_auth_dropbox_client_id")
+        _dbx_secret = _get_effective("social_auth_dropbox_client_secret")
+        if _is_truthy(_get_effective("social_auth_dropbox_use_global_credentials")) and not (_dbx_id and _dbx_secret):
+            _dbx_id = _dbx_id or _get_effective("dropbox_app_key")
+            _dbx_secret = _dbx_secret or _get_effective("dropbox_app_secret")
+        _dropbox_linked = bool(_is_truthy(_get_effective("social_auth_dropbox_enabled")) and _dbx_id and _dbx_secret)
         services.append(
             {
                 "key": "dropbox",
                 "name": "Dropbox",
                 "icon": "fab fa-dropbox",
                 "type": "Sign-in authentication",
-                "linked": "dropbox" in SOCIAL_PROVIDERS,
+                "linked": _dropbox_linked,
                 "description": "Sign-in authentication",
                 "settings_keys": [
                     "social_auth_dropbox_enabled",
@@ -336,13 +367,20 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
         )
 
         # --- Keycloak ---
+        _keycloak_linked = bool(
+            _is_truthy(_get_effective("social_auth_keycloak_enabled"))
+            and _get_effective("social_auth_keycloak_client_id")
+            and _get_effective("social_auth_keycloak_client_secret")
+            and _get_effective("social_auth_keycloak_server_url")
+            and _get_effective("social_auth_keycloak_realm")
+        )
         services.append(
             {
                 "key": "keycloak",
                 "name": "Keycloak",
                 "icon": "fas fa-key",
                 "type": "SSO",
-                "linked": "keycloak" in SOCIAL_PROVIDERS,
+                "linked": _keycloak_linked,
                 "description": "SSO",
                 "settings_keys": [
                     "social_auth_keycloak_enabled",
@@ -355,13 +393,20 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
         )
 
         # --- Generic OAuth2 ---
+        _generic_oauth2_linked = bool(
+            _is_truthy(_get_effective("social_auth_generic_oauth2_enabled"))
+            and _get_effective("social_auth_generic_oauth2_client_id")
+            and _get_effective("social_auth_generic_oauth2_client_secret")
+            and _get_effective("social_auth_generic_oauth2_authorize_url")
+            and _get_effective("social_auth_generic_oauth2_token_url")
+        )
         services.append(
             {
                 "key": "generic_oauth2",
                 "name": "Generic OAuth2",
                 "icon": "fas fa-sign-in-alt",
                 "type": "SSO",
-                "linked": "generic_oauth2" in SOCIAL_PROVIDERS,
+                "linked": _generic_oauth2_linked,
                 "description": "SSO",
                 "settings_keys": [
                     "social_auth_generic_oauth2_enabled",
@@ -464,7 +509,7 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
 
         # Feature toggles
         sso_auto_login = _is_truthy(_get_effective("sso_auto_login"))
-        qr_login_enabled = _is_truthy(_get_effective("qr_login_challenge_ttl_seconds"))
+        qr_login_enabled = _is_truthy(_get_effective("qr_login_enabled"))
         frontend_url_configured = bool(_get_effective("public_base_url"))
 
         return templates.TemplateResponse(
@@ -474,7 +519,7 @@ async def connections_page(request: Request, db: Session = Depends(get_db)):
                 "services": services,
                 "service_settings": service_settings,
                 "sso_auto_login": sso_auto_login,
-                "oauth_configured": OAUTH_CONFIGURED,
+                "oauth_configured": _oidc_linked,
                 "qr_login_enabled": qr_login_enabled,
                 "frontend_url_configured": frontend_url_configured,
                 "app_version": settings.version,

app/views/share.py

@@ -23,6 +23,7 @@ templates = Jinja2Templates(directory=str(_templates_dir))
 async def shared_link_view(request: Request, token: str):
     """Render the public share landing page for a given token."""
     return templates.TemplateResponse(
+        request,
         "shared_link_view.html",
-        {"request": request, "token": token},
+        context={"token": token},
     )

docker-compose.yaml

@@ -3,7 +3,7 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    # No container_name — allows `docker compose up --scale api=N`
+    container_name: document_api
     restart: always
 
     # We'll keep the code in /app, but set working_dir to the shared data directory
@@ -24,7 +24,7 @@ services:
 
     depends_on:
       - redis
-      - beat
+      - worker
 
     # Mount the shared working directory for data
     volumes:
@@ -34,14 +34,13 @@ services:
     build:
       context: .
       dockerfile: Dockerfile
-    # No container_name — allows `docker compose up --scale worker=N`
+    container_name: document_worker
     restart: always
 
     # same shared working directory
     working_dir: /workdir
 
-    # Workers process tasks only — no -B flag (Beat runs in the dedicated beat service)
+    command: ["celery", "-A", "app.celery_worker", "worker", "-B", "--loglevel=info", "-Q", "document_processor,default,celery"]
-    command: ["celery", "-A", "app.celery_worker", "worker", "--loglevel=info", "-Q", "document_processor,default,celery"]
     env_file:
       - .env
     environment:
@@ -55,26 +54,6 @@ services:
     volumes:
       - /var/docparse/workdir:/workdir
 
-  # Dedicated Celery Beat scheduler — exactly one instance must run at all times.
-  # Beat publishes periodic tasks to the Redis broker; workers pick them up.
-  # Do NOT scale this service (replicas must stay at 1).
-  beat:
-    build:
-      context: .
-      dockerfile: Dockerfile
-    container_name: document_beat
-    restart: always
-    working_dir: /workdir
-    command: ["celery", "-A", "app.celery_worker", "beat", "--loglevel=info"]
-    env_file:
-      - .env
-    environment:
-      - PYTHONPATH=/app
-    depends_on:
-      - redis
-    volumes:
-      - /var/docparse/workdir:/workdir
-
   gotenberg:
     image: gotenberg/gotenberg:latest
     container_name: gotenberg

docs/ConfigurationGuide.md

@@ -792,7 +792,7 @@ SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self'; style-src 'sel
 SECURITY_HEADER_CSP_VALUE="default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline';"
 ```
 
-**Note:** The default policy includes `'unsafe-inline'` for compatibility with Tailwind CSS and inline JavaScript. For stricter security, use nonces or hashes.
+**Note:** The default policy includes `'unsafe-inline'` for compatibility with inline JavaScript. Tailwind CSS v3 is compiled at build time into a static file served from `'self'`, so no external style CDN is needed.
 
 #### X-Frame-Options
 
@@ -1330,6 +1330,19 @@ For detailed setup instructions, see the [Google Drive Setup Guide](GoogleDriveS
 | `DEST_EMAIL_SENDER`             | From address for delivered documents (e.g., `"DocuElevate Delivery <docuelevate@example.com>"`). |
 | `DEST_EMAIL_DEFAULT_RECIPIENT`  | Fallback recipient email when none is specified for a delivery task.  |
 
+### Evernote
+
+| **Variable**                  | **Description**                                                     |
+|-------------------------------|---------------------------------------------------------------------|
+| `EVERNOTE_ENABLED`            | Set to `false` to disable Evernote uploads without removing credentials. Default: `true` |
+| `EVERNOTE_AUTH_TOKEN`         | Evernote developer token or OAuth access token used to create notes. |
+| `EVERNOTE_SANDBOX`            | Use Evernote sandbox API endpoints. Default: `false`                 |
+| `EVERNOTE_NOTEBOOK_GUID`      | Optional target notebook GUID. If omitted, Evernote uses the default notebook. |
+| `EVERNOTE_DEFAULT_TAGS`       | Optional comma-separated tags applied to every created note.         |
+| `EVERNOTE_INCLUDE_METADATA`   | Include extracted metadata in the Evernote note body. Default: `true` |
+
+For detailed setup instructions, see the [Evernote Setup Guide](EvernoteSetup.md).
+
 ### OneDrive / Microsoft Graph
 
 | **Variable**                    | **Description**                                       |

docs/ConfigurationMaster.md

@@ -13,6 +13,7 @@ DocuElevate is designed to be highly configurable through environment variables,
 - [Dropbox Setup](DropboxSetup.md) - How to set up Dropbox integration
 - [OneDrive Setup](OneDriveSetup.md) - How to set up Microsoft OneDrive/Graph integration
 - [Amazon S3 Setup](AmazonS3Setup.md) - How to set up Amazon S3 integration
+- [Evernote Setup](EvernoteSetup.md) - How to set up Evernote note creation
 - [Authentication Setup](AuthenticationSetup.md) - How to set up user authentication
 - [Notifications Setup](NotificationsSetup.md) - How to set up system notifications
 

docs/EvernoteSetup.md

@@ -0,0 +1,51 @@
+# Setting up Evernote Integration
+
+This guide explains how to configure DocuElevate to create Evernote notes for processed documents.
+
+## Overview
+
+The Evernote destination creates one note per processed document. The note contains:
+
+- A visible metadata section populated from DocuElevate's extracted metadata JSON
+- The processed PDF attached as an Evernote resource
+- Optional tags from `EVERNOTE_DEFAULT_TAGS` plus extracted document tags
+
+## Required Configuration
+
+| Variable | Description |
+|----------|-------------|
+| `EVERNOTE_ENABLED` | Set to `false` to disable Evernote uploads without removing credentials. Default: `true` |
+| `EVERNOTE_AUTH_TOKEN` | Evernote developer token or OAuth access token with note creation permissions |
+
+## Optional Configuration
+
+| Variable | Description |
+|----------|-------------|
+| `EVERNOTE_SANDBOX` | Use Evernote sandbox API endpoints. Default: `false` |
+| `EVERNOTE_NOTEBOOK_GUID` | Target notebook GUID. If omitted, Evernote uses the account default notebook |
+| `EVERNOTE_DEFAULT_TAGS` | Comma-separated tags to apply to every created note, for example `docuelevate,archive` |
+| `EVERNOTE_INCLUDE_METADATA` | Include extracted metadata in the note body. Default: `true` |
+
+## Example
+
+```dotenv
+EVERNOTE_ENABLED=true
+EVERNOTE_AUTH_TOKEN=your-evernote-token
+EVERNOTE_NOTEBOOK_GUID=optional-notebook-guid
+EVERNOTE_DEFAULT_TAGS=docuelevate,processed
+EVERNOTE_INCLUDE_METADATA=true
+```
+
+## Metadata and Attachments
+
+DocuElevate reads the companion metadata file next to the processed PDF, for example `invoice.pdf` and `invoice.json`. Non-empty metadata fields are rendered into the Evernote note body. Values such as `Unknown`, empty strings, and null values are skipped.
+
+If the metadata contains a `tags` field, those tags are applied to the note together with any tags configured in `EVERNOTE_DEFAULT_TAGS`.
+
+The processed PDF is attached directly to the note using Evernote's resource model, so it appears as a normal Evernote attachment.
+
+## Notes
+
+- Evernote tokens can expire or be revoked. If uploads start failing with authentication errors, generate or refresh the token and update `EVERNOTE_AUTH_TOKEN`.
+- If `EVERNOTE_NOTEBOOK_GUID` points to a missing or inaccessible notebook, Evernote will reject the note creation request.
+- Evernote enforces account upload quotas and per-note size limits. Large PDFs may fail if they exceed those limits.

docs/ProductionReadiness.md

@@ -157,7 +157,7 @@ Recommended headers to configure at the proxy level:
 
 #### Content-Security-Policy Notes
 
-DocuElevate's frontend uses Tailwind CSS loaded from CDN in development mode.  In production, ensure your CSP allows loading scripts and styles from your configured static file origin.  A starting point:
+DocuElevate's frontend uses Tailwind CSS v3 compiled at Docker build time. No external CDN requests are needed for CSS. In production, your CSP does not need to allow any external style sources beyond your own static file origin.  A starting point:
 
 ```
 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;

docs/README.md

@@ -24,6 +24,7 @@ Welcome to the DocuElevate documentation. This directory contains comprehensive
   - [OneDrive Setup](OneDriveSetup.md) - How to set up Microsoft OneDrive/Graph integration
   - [SharePoint Setup](SharePointSetup.md) - How to set up Microsoft SharePoint Online integration
   - [Amazon S3 Setup](AmazonS3Setup.md) - How to set up Amazon S3 integration
+  - [Evernote Setup](EvernoteSetup.md) - How to set up Evernote note creation
   - [Authentication Setup](AuthenticationSetup.md) - How to set up user authentication
   - [Notifications Setup](NotificationsSetup.md) - How to set up system notifications
 

docs/SentrySetup.md

@@ -181,7 +181,7 @@ Simply leave `SENTRY_DSN` unset (or set it to an empty string).  Neither the Pyt
 ## SDK Version
 
 - **Server:** DocuElevate uses [`sentry-sdk`](https://pypi.org/project/sentry-sdk/) `>=2.20.0,<3.0.0` with the `fastapi`, `celery`, and `sqlalchemy` extras.
-- **Browser:** The `bundle.tracing.replay.min.js` bundle is loaded from the official Sentry CDN (`browser.sentry-cdn.com`).  The version pin is in `frontend/templates/base.html`.
+- **Browser:** The `bundle.tracing.replay.min.js` bundle from the Sentry Browser SDK **v10** is loaded from the official Sentry CDN (`browser.sentry-cdn.com`).  The version pin is in `frontend/templates/base.html`.
 
 ---
 

docs/SettingsManagement.md

@@ -28,7 +28,7 @@ Settings are organized into logical categories for easy navigation:
 - **Authentication**: Login settings, session secrets, OAuth configuration, admin group
 - **AI Services**: AI provider selection, model configuration, embeddings, and credentials (OpenAI, Azure, Anthropic, Gemini, Ollama, OpenRouter, Portkey, LiteLLM)
 - **OCR Engines**: OCR provider selection and configuration (Tesseract, EasyOCR, Mistral, Google DocAI, AWS Textract)
-- **Storage Providers**: Dropbox, Google Drive, OneDrive, SharePoint, S3, FTP, SFTP, WebDAV, Nextcloud, Paperless
+- **Storage Providers**: Dropbox, Google Drive, OneDrive, SharePoint, S3, FTP, SFTP, WebDAV, Nextcloud, Paperless, Evernote
 - **Email**: SMTP configuration for sending emails
 - **IMAP**: Email ingestion configuration (supports two mailbox accounts)
 - **Monitoring**: Uptime Kuma integration

docs/SetupWizard.md

@@ -125,6 +125,7 @@ Several cloud storage integrations include their own guided configuration pages
 | Google Drive | `/google-drive-setup` | [GoogleDriveSetup.md](GoogleDriveSetup.md) |
 | OneDrive / SharePoint | `/onedrive-setup` | [OneDriveSetup.md](OneDriveSetup.md) |
 | Amazon S3 | Configured via settings | [AmazonS3Setup.md](AmazonS3Setup.md) |
+| Evernote | Configured via settings | [EvernoteSetup.md](EvernoteSetup.md) |
 
 These pages are accessed **after** the main Setup Wizard is complete and are independent wizard flows specific to each integration.
 

frontend/input.css

@@ -0,0 +1,329 @@
+/* frontend/input.css
+ * Tailwind CSS v3 source file.
+ * Edit this file (not static/styles.css) — the compiled output is
+ * generated by running:  npm run build   (inside the frontend/ directory)
+ */
+
+/* ── Tailwind layers ──────────────────────────────────────────────────────── */
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+/* ── Custom utilities ─────────────────────────────────────────────────────── */
+
+/* =============================================================
+   ACCESSIBILITY
+   Skip-to-content link, focus indicators, and screen-reader-only
+   utility class following WCAG 2.1 Level AA requirements.
+   ============================================================= */
+
+/* Skip-to-content link: visible only on keyboard focus */
+.skip-link {
+  position: absolute;
+  left: -9999px;
+  top: auto;
+  width: 1px;
+  height: 1px;
+  overflow: hidden;
+  z-index: 9999;
+  padding: 0.75rem 1.5rem;
+  background-color: #1d4ed8;
+  color: #ffffff;
+  font-weight: 600;
+  text-decoration: none;
+  border-radius: 0 0 0.375rem 0;
+}
+.skip-link:focus {
+  position: fixed;
+  top: 0;
+  left: 0;
+  width: auto;
+  height: auto;
+  outline: 2px solid #2563eb;
+  outline-offset: 2px;
+}
+
+/* Enhanced focus-visible indicators for keyboard navigation (WCAG 2.4.7) */
+a:focus-visible,
+button:focus-visible,
+input:focus-visible,
+select:focus-visible,
+textarea:focus-visible,
+[tabindex]:focus-visible {
+  outline: 2px solid #2563eb;
+  outline-offset: 2px;
+}
+
+/* Screen-reader-only utility (visually hidden, accessible to AT) */
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border-width: 0;
+}
+
+body {
+    /* Your global overrides can go here if needed */
+  }
+  .material-symbols-light--folder-managed-outline {
+    display: inline-block;
+    width: 96px;
+    height: 96px;
+    --svg: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath fill='%23000' d='m17.212 20.404l-.108-.885q-.57-.125-.938-.33q-.368-.204-.7-.577l-.835.334l-.539-.815l.689-.577q-.165-.531-.165-1.035t.165-1.034l-.689-.577l.539-.816l.835.335q.332-.393.7-.588q.369-.195.938-.32l.108-.885h1l.107.885q.57.125.938.32t.7.588l.835-.335l.539.816l-.689.576q.166.531.166 1.035t-.166 1.035l.689.577l-.539.815l-.834-.335q-.333.373-.701.578q-.369.205-.938.33l-.107.885zm.5-1.731q.882 0 1.518-.635q.636-.636.636-1.519t-.636-1.518t-1.518-.636t-1.519.636t-.635 1.518t.635 1.519t1.518.635M4 18V6v4.435V10zm.616 1q-.691 0-1.153-.462T3 17.384V6.616q0-.691.463-1.153T4.615 5h4.981l2 2h7.789q.69 0 1.153.463T21 8.616v2.294q-.238-.152-.479-.265q-.24-.112-.521-.21v-1.82q0-.269-.173-.442T19.385 8h-8.19l-2-2h-4.58q-.269 0-.442.173T4 6.616v10.769q0 .269.173.442t.443.173h6.748q.055.275.131.515t.186.485z'/%3E%3C/svg%3E");
+    background-color: currentColor;
+    -webkit-mask-image: var(--svg);
+    mask-image: var(--svg);
+    -webkit-mask-repeat: no-repeat;
+    mask-repeat: no-repeat;
+    -webkit-mask-size: 100% 100%;
+    mask-size: 100% 100%;
+  }
+
+  /* Ensure pagination wraps properly on small screens */
+  .pagination {
+    flex-wrap: wrap;
+    gap: 0.5rem;
+  }
+  .pagination-buttons {
+    flex-wrap: wrap;
+  }
+
+  /* Ensure filter items stack on very small screens */
+  @media (max-width: 480px) {
+    .filter-group {
+      flex-direction: column;
+    }
+    .filter-item {
+      min-width: unset;
+      width: 100%;
+    }
+  }
+
+/* =============================================================
+   DARK MODE
+   Activated by "dark" class on <html> element.
+   Toggled by the navbar button; preference stored in localStorage.
+   Falls back to the server-side ui_default_color_scheme setting,
+   then to the OS prefers-color-scheme media query.
+   WCAG AA contrast ratios verified for all text/background pairs.
+   ============================================================= */
+
+/* Tell the browser we support both colour schemes */
+html { color-scheme: light; }
+html.dark { color-scheme: dark; }
+
+/* ---- Base / Body ---- */
+html.dark body { background-color: #111827; color: #e5e7eb; }
+html.dark .bg-gray-50 { background-color: #111827; }
+html.dark .bg-white   { background-color: #1f2937; }
+html.dark .bg-gray-100 { background-color: #374151; }
+html.dark .bg-gray-200 { background-color: #4b5563; }
+
+/* ---- Text colours ---- */
+html.dark .text-gray-900 { color: #f9fafb; }
+html.dark .text-gray-800 { color: #f3f4f6; }
+html.dark .text-gray-700 { color: #e5e7eb; }
+html.dark .text-gray-600 { color: #d1d5db; }
+html.dark .text-gray-500 { color: #9ca3af; }
+html.dark .text-gray-400 { color: #9ca3af; }
+html.dark .text-black    { color: #f9fafb; }
+
+/* ---- Borders ---- */
+html.dark .border-gray-100 { border-color: #374151; }
+html.dark .border-gray-200 { border-color: #374151; }
+html.dark .border-gray-300 { border-color: #4b5563; }
+html.dark .border-gray-400 { border-color: #6b7280; }
+html.dark .divide-gray-200 > :not([hidden]) ~ :not([hidden]) { border-color: #374151; }
+html.dark .divide-gray-100 > :not([hidden]) ~ :not([hidden]) { border-color: #374151; }
+html.dark .divide-y > :not([hidden]) ~ :not([hidden]) { border-color: #374151; }
+
+/* ---- Hover states ---- */
+html.dark .hover\:bg-gray-50:hover  { background-color: #374151; }
+html.dark .hover\:bg-gray-100:hover { background-color: #4b5563; }
+html.dark .hover\:text-gray-900:hover { color: #f9fafb; }
+html.dark .hover\:text-gray-700:hover { color: #e5e7eb; }
+
+/* ---- Shadows (softened for dark mode) ---- */
+html.dark .shadow,
+html.dark .shadow-md,
+html.dark .shadow-sm,
+html.dark .shadow-lg {
+  box-shadow: 0 1px 3px 0 rgba(0,0,0,0.6), 0 1px 2px 0 rgba(0,0,0,0.4);
+}
+
+/* ---- Alert / info-banner backgrounds ---- */
+html.dark .bg-blue-50   { background-color: #1e3a5f; }
+html.dark .bg-green-50  { background-color: #052e16; }
+html.dark .bg-red-50    { background-color: #450a0a; }
+html.dark .bg-yellow-50 { background-color: #451a03; }
+html.dark .bg-indigo-50 { background-color: #1e1b4b; }
+html.dark .bg-orange-50 { background-color: #431407; }
+
+/* ---- Badge / pill backgrounds ---- */
+html.dark .bg-blue-100   { background-color: #1e3a5f; }
+html.dark .bg-green-100  { background-color: #052e16; }
+html.dark .bg-red-100    { background-color: #450a0a; }
+html.dark .bg-yellow-100 { background-color: #451a03; }
+html.dark .bg-indigo-100 { background-color: #431407; }
+html.dark .bg-orange-100 { background-color: #431407; }
+html.dark .bg-purple-100 { background-color: #2e1065; }
+
+/* ---- Status / badge text colours ---- */
+html.dark .text-blue-700  { color: #93c5fd; }
+html.dark .text-blue-800  { color: #bfdbfe; }
+html.dark .text-green-700 { color: #86efac; }
+html.dark .text-green-800 { color: #bbf7d0; }
+html.dark .text-red-700   { color: #fca5a5; }
+html.dark .text-red-800   { color: #fecaca; }
+html.dark .text-yellow-700 { color: #fcd34d; }
+html.dark .text-yellow-800 { color: #fde68a; }
+html.dark .text-indigo-700 { color: #a5b4fc; }
+html.dark .text-indigo-800 { color: #c7d2fe; }
+html.dark .text-orange-700 { color: #fdba74; }
+html.dark .text-orange-800 { color: #fed7aa; }
+html.dark .text-purple-700 { color: #d8b4fe; }
+html.dark .text-purple-800 { color: #e9d5ff; }
+
+/* ---- Dropdown / popup menus ---- */
+html.dark .bg-white.rounded-md.shadow-lg { background-color: #1f2937; }
+html.dark .ring-black { --tw-ring-color: rgba(0,0,0,0.5); }
+
+/* ---- Form inputs / selects / textareas ---- */
+html.dark input:not([type="checkbox"]):not([type="radio"]):not([type="range"]),
+html.dark select,
+html.dark textarea {
+  background-color: #374151;
+  border-color: #4b5563;
+  color: #e5e7eb;
+}
+html.dark input::placeholder,
+html.dark textarea::placeholder {
+  color: #9ca3af;
+}
+html.dark input:focus:not([type="checkbox"]):not([type="radio"]):not([type="range"]),
+html.dark select:focus,
+html.dark textarea:focus {
+  border-color: #60a5fa;
+  outline-color: #60a5fa;
+}
+
+/* ---- Table rows ---- */
+html.dark thead,
+html.dark .bg-gray-50 thead { background-color: #1f2937; }
+html.dark thead th { color: #9ca3af; }
+html.dark tbody tr:hover { background-color: #374151; }
+
+/* ---- Code / pre ---- */
+html.dark pre,
+html.dark code { background-color: #111827; color: #d1d5db; }
+
+/* ---- Dark-mode toggle button icon colour ---- */
+html.dark #darkModeToggle { color: #fbbf24; }
+html.dark #darkModeToggle:hover { background-color: #374151; }
+
+/* ---- Dark-mode skip-link ---- */
+html.dark .skip-link { background-color: #2563eb; }
+html.dark .skip-link:focus { outline-color: #60a5fa; }
+
+/* ---- Dark-mode focus-visible indicators ---- */
+html.dark a:focus-visible,
+html.dark button:focus-visible,
+html.dark input:focus-visible,
+html.dark select:focus-visible,
+html.dark textarea:focus-visible,
+html.dark [tabindex]:focus-visible {
+  outline-color: #60a5fa;
+}
+
+/* ---- Scrollbar (WebKit browsers) ---- */
+html.dark ::-webkit-scrollbar { width: 8px; height: 8px; }
+html.dark ::-webkit-scrollbar-track { background: #1f2937; }
+html.dark ::-webkit-scrollbar-thumb { background: #4b5563; border-radius: 4px; }
+html.dark ::-webkit-scrollbar-thumb:hover { background: #6b7280; }
+
+/* ---- Settings page: sidebar active state (dark) ---- */
+html.dark .bg-blue-50 { background-color: #1e3a5f; }
+
+/* =============================================================
+   DOC-TOGGLE  –  cross-browser toggle switch
+   Implemented with custom CSS pseudo-elements so the appearance
+   is consistent across all browsers regardless of Tailwind version.
+   Usage:
+     <label class="doc-toggle">
+       <input type="checkbox" class="sr-only" onchange="...">
+       <span class="doc-toggle-track" aria-hidden="true"></span>
+       <span class="ml-3 ...">Label text</span>
+     </label>
+   ============================================================= */
+
+.doc-toggle {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+  cursor: pointer;
+}
+
+.doc-toggle-track {
+  position: relative;
+  display: inline-block;
+  width: 44px;
+  min-width: 44px;
+  height: 24px;
+  background-color: #e5e7eb; /* gray-200 */
+  border-radius: 9999px;
+  transition: background-color 0.2s ease-in-out;
+  flex-shrink: 0;
+}
+
+.doc-toggle-track::after {
+  content: '';
+  position: absolute;
+  top: 2px;
+  left: 2px;
+  width: 20px;
+  height: 20px;
+  background-color: #ffffff;
+  border: 1px solid #d1d5db; /* gray-300 */
+  border-radius: 9999px;
+  transition: transform 0.2s ease-in-out, border-color 0.2s ease-in-out;
+}
+
+.doc-toggle input[type="checkbox"]:checked + .doc-toggle-track {
+  background-color: #4f46e5; /* indigo-600 */
+}
+
+.doc-toggle input[type="checkbox"]:checked + .doc-toggle-track::after {
+  transform: translateX(20px);
+  border-color: #ffffff;
+}
+
+.doc-toggle input[type="checkbox"]:focus-visible + .doc-toggle-track {
+  box-shadow: 0 0 0 2px #ffffff, 0 0 0 4px #6366f1; /* ring-2 ring-indigo-500 with offset */
+}
+
+/* Dark mode overrides */
+html.dark .doc-toggle-track {
+  background-color: #374151; /* gray-700 */
+}
+
+html.dark .doc-toggle-track::after {
+  background-color: #ffffff;
+  border-color: #4b5563; /* gray-600 */
+}
+
+html.dark .doc-toggle input[type="checkbox"]:checked + .doc-toggle-track {
+  background-color: #4f46e5; /* indigo-600 */
+}
+
+html.dark .doc-toggle input[type="checkbox"]:checked + .doc-toggle-track::after {
+  border-color: #ffffff;
+}
+
+html.dark .doc-toggle input[type="checkbox"]:focus-visible + .doc-toggle-track {
+  box-shadow: 0 0 0 2px #111827, 0 0 0 4px #6366f1; /* dark background offset */
+}

frontend/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "docuelevate-frontend",
+  "version": "1.0.0",
+  "description": "Frontend asset compilation for DocuElevate",
+  "scripts": {
+    "build": "tailwindcss -i input.css -o static/styles.css --minify",
+    "watch": "tailwindcss -i input.css -o static/styles.css --watch"
+  },
+  "devDependencies": {
+    "tailwindcss": "^3.4.0"
+  }
+}

frontend/static/js/annotations.js

@@ -24,6 +24,10 @@
     _i18n = i18n || {};
     _loadAnnotations();
 
+    // Expose reload function so the EmbedPDF viewer init script can refresh the
+    // list after auto-saving an annotation created inside the viewer.
+    window._reloadAnnotations = _loadAnnotations;
+
     var form = document.getElementById('annotation-form');
     if (form) {
       form.addEventListener('submit', function (e) {
@@ -81,10 +85,18 @@
     typeBadge.className = 'annotation-type annotation-type--' + ann.annotation_type;
     typeBadge.textContent = _i18n['type_' + ann.annotation_type] || ann.annotation_type;
 
-    var pageInfo = document.createElement('span');
+    var pageInfo = document.createElement('button');
-    pageInfo.className = 'annotation-page';
+    pageInfo.type = 'button';
+    pageInfo.className = 'annotation-page annotation-page--link';
+    pageInfo.setAttribute('aria-label', (_i18n.go_to_page || 'Go to page') + ' ' + ann.page);
+    pageInfo.title = (_i18n.go_to_page || 'Go to page') + ' ' + ann.page;
     pageInfo.innerHTML = '<i class="fas fa-file-alt" aria-hidden="true"></i> ' +
       (_i18n.page || 'Page') + ' ' + ann.page;
+    pageInfo.addEventListener('click', function () {
+      if (typeof window._embedpdfScrollToPage === 'function') {
+        window._embedpdfScrollToPage(ann.page);
+      }
+    });
 
     header.appendChild(typeBadge);
     if (ann.color) {

frontend/static/js/claim.js

@@ -0,0 +1,44 @@
+/**
+ * claim.js — Claim-ownership UI helper for unowned documents.
+ *
+ * Usage: call initClaimOwnership(fileId, i18n) after DOMContentLoaded.
+ * The i18n object must contain:
+ *   confirm, success, failed
+ */
+function initClaimOwnership(fileId, i18n) {
+  var btn = document.getElementById('claim-btn');
+  var msg = document.getElementById('claim-msg');
+  if (!btn) return;
+
+  btn.addEventListener('click', function () {
+    if (!confirm(i18n.confirm)) return;
+    btn.disabled = true;
+    fetch('/api/files/' + fileId + '/claim', { method: 'POST' })
+      .then(function (r) { return r.json().then(function (d) { return { ok: r.ok, data: d }; }); })
+      .then(function (result) {
+        if (result.ok || (result.data && result.data.status === 'already_owned')) {
+          if (msg) {
+            msg.textContent = i18n.success;
+            msg.style.color = '#059669';
+            msg.style.display = msg.tagName === 'SPAN' ? 'inline' : 'block';
+          }
+          setTimeout(function () { location.reload(); }, 1200);
+        } else {
+          if (msg) {
+            msg.textContent = (result.data && result.data.detail) || i18n.failed;
+            msg.style.color = '#dc2626';
+            msg.style.display = msg.tagName === 'SPAN' ? 'inline' : 'block';
+          }
+          btn.disabled = false;
+        }
+      })
+      .catch(function () {
+        if (msg) {
+          msg.textContent = i18n.failed;
+          msg.style.color = '#dc2626';
+          msg.style.display = msg.tagName === 'SPAN' ? 'inline' : 'block';
+        }
+        btn.disabled = false;
+      });
+  });
+}

frontend/static/js/upload.js

@@ -293,13 +293,24 @@ function processFiles(files, progressContainer, statusMessage) {
     updateStatus();
   }
 
+  function _escapeHtml(str) {
+    if (!str) return '';
+    return String(str)
+      .replace(/&/g, '&')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#039;');
+  }
+
   // Pre-create one progress row per file.
   const queueItems = fileArray.map((file) => {
     const row = document.createElement('div');
     row.className = 'flex flex-col mb-2';
+    const safeFileName = _escapeHtml(file.name);
     row.innerHTML = `
       <div class="flex justify-between">
-        <span class="text-sm truncate" title="${file.name}">${file.name}</span>
+        <span class="text-sm truncate" title="${safeFileName}">${safeFileName}</span>
         <span class="text-xs text-gray-500">${formatFileSize(file.size)}</span>
       </div>
       <div class="w-full bg-gray-200 h-2 rounded-full mt-1">
@@ -546,4 +557,3 @@ function initDragAndDrop(element, progressContainer, statusMessage, options = {}
   });
 }
 
-

frontend/tailwind.config.js

@@ -0,0 +1,12 @@
+/** @type {import('tailwindcss').Config} */
+module.exports = {
+  content: [
+    './templates/**/*.html',
+    './static/js/**/*.js',
+  ],
+  darkMode: 'class',
+  theme: {
+    extend: {},
+  },
+  plugins: [],
+}

frontend/templates/admin_connections.html

@@ -18,11 +18,11 @@
         <p class="text-sm text-gray-500 dark:text-gray-400 mt-1">{{ _("connections.sso_auto_login_description") }}</p>
       </div>
       <div>
-        <label class="relative inline-flex items-center cursor-pointer">
+        <label class="doc-toggle">
-          <input type="checkbox" id="sso-auto-login-toggle" class="sr-only peer"
+          <input type="checkbox" id="sso-auto-login-toggle" class="sr-only"
                  {% if sso_auto_login %}checked{% endif %}
                  onchange="toggleSetting('sso_auto_login', this.checked)">
-          <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-indigo-500 rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all dark:border-gray-600 peer-checked:bg-indigo-600" style="min-width:44px; min-height:24px;"></div>
+          <span class="doc-toggle-track" aria-hidden="true"></span>
           <span class="ml-3 text-sm font-medium text-gray-700 dark:text-gray-300">{{ _("connections.sso_auto_login") }}</span>
         </label>
       </div>
@@ -44,10 +44,11 @@
         {% endif %}
       </div>
       <div>
-        <label class="relative inline-flex items-center cursor-pointer">
+        <label class="doc-toggle">
-          <input type="checkbox" id="qr-upload-toggle" class="sr-only peer"
+          <input type="checkbox" id="qr-upload-toggle" class="sr-only"
-                 {% if qr_login_enabled %}checked{% endif %} disabled>
+                 {% if qr_login_enabled %}checked{% endif %}
-          <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-indigo-500 rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all dark:border-gray-600 peer-checked:bg-indigo-600" style="min-width:44px; min-height:24px;"></div>
+                 onchange="toggleSetting('qr_login_enabled', this.checked)">
+          <span class="doc-toggle-track" aria-hidden="true"></span>
           <span class="ml-3 text-sm font-medium text-gray-700 dark:text-gray-300">{{ _("connections.qr_code_enabled") }}</span>
         </label>
       </div>
@@ -199,24 +200,24 @@ function openServiceModal(serviceKey) {
     }
 
     if (meta.type === 'boolean') {
-      // Styled Tailwind toggle switch (matches the page-level toggles)
+      // Styled toggle switch using .doc-toggle CSS class (compatible with Tailwind v2 CDN).
       const toggleWrapper = document.createElement('label');
-      toggleWrapper.className = 'relative inline-flex items-center cursor-pointer';
+      toggleWrapper.className = 'doc-toggle';
       toggleWrapper.setAttribute('aria-label', field.key.replace(/_/g, ' ').replace(/\b\w/g, function(c) { return c.toUpperCase(); }));
 
       const checkbox = document.createElement('input');
       checkbox.type = 'checkbox';
       checkbox.id = 'field-' + field.key;
       checkbox.name = field.key;
-      checkbox.className = 'sr-only peer';
+      checkbox.className = 'sr-only';
       const val = field.value;
       if (val === true || val === 'true' || val === '1' || val === 'True') {
         checkbox.checked = true;
       }
 
-      const slider = document.createElement('div');
+      const slider = document.createElement('span');
-      slider.className = "w-11 h-6 bg-gray-200 peer-focus:outline-none peer-focus:ring-2 peer-focus:ring-indigo-500 rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:border-gray-300 after:border after:rounded-full after:h-5 after:w-5 after:transition-all dark:border-gray-600 peer-checked:bg-indigo-600";
+      slider.className = 'doc-toggle-track';
-      slider.style.cssText = 'min-width:44px; min-height:24px;';
+      slider.setAttribute('aria-hidden', 'true');
 
       toggleWrapper.appendChild(checkbox);
       toggleWrapper.appendChild(slider);

frontend/templates/base.html

@@ -21,8 +21,6 @@
     <!-- Alpine.js moved to head for earlier loading -->
     <script src="https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js" defer></script>
     {% block head_css %}
-    <!-- Tailwind CSS and other CSS -->
-    <link href="https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css" rel="stylesheet">
     <!-- Font Awesome -->
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css"
           integrity="sha512-DTOQO9RWCH3ppGqcWaEA1BIZOC6xxalwEsw9c2QQeAIftl+Vegovlnee1c9QX4TctnWMn13TZye+giMm8e2LwA=="
@@ -41,8 +39,10 @@
          upgrading the SDK.
     ──────────────────────────────────────────────────────────────────────── #}
     {% if sentry_dsn %}
-    <script src="https://browser.sentry-cdn.com/9.x.x/bundle.tracing.replay.min.js"
+    <script src="https://browser.sentry-cdn.com/10.45.0/bundle.tracing.replay.feedback.logs.metrics.min.js"
-            crossorigin="anonymous"></script>
+      integrity="sha384-TCY3xw5Ej940LIWfS6PwhCCBl7lvEsxBpHy+BirF+EycSQUvXbfZsgsLi0oU18yZ"
+      crossorigin="anonymous"
+    ></script>
     <script>
       if (window.Sentry) {
         Sentry.init({

frontend/templates/file_annotations.html

@@ -380,6 +380,23 @@
       font-size: 0.75rem;
       color: #718096;
     }
+    .annotation-page--link {
+      background: none;
+      border: none;
+      padding: 0;
+      cursor: pointer;
+      font-size: 0.75rem;
+      color: #718096;
+      text-decoration: none;
+      min-height: 0;
+    }
+    .annotation-page--link:hover {
+      color: #3182ce;
+      text-decoration: underline;
+    }
+    .dark .annotation-page--link:hover {
+      color: #63b3ed;
+    }
     .annotation-content {
       color: #4a5568;
       font-size: 0.9375rem;
@@ -569,6 +586,23 @@
         Comments & Annotations
       </div>
       <div class="annotations-subtitle">{{ file.original_filename }}</div>
+      {% if multi_user_enabled %}
+      <div class="annotations-subtitle" style="margin-top:0.25rem;">
+        <i class="fas fa-user" aria-hidden="true" style="margin-right:0.25rem;"></i>
+        {{ _("file.owner_label") }}: <strong>{{ owner_display or _("file.owner_unowned") }}</strong>
+        {% if file.owner_id is none %}
+        &mdash;
+        <button
+          id="claim-btn"
+          aria-label="{{ _('file.claim_ownership') }}"
+          style="background:#10b981;color:#fff;border:none;border-radius:0.375rem;padding:0.25rem 0.75rem;font-size:0.8rem;font-weight:600;cursor:pointer;"
+        >
+          <i class="fas fa-user-check" aria-hidden="true"></i> {{ _("file.claim_ownership") }}
+        </button>
+        <span id="claim-msg" style="font-size:0.8rem;margin-left:0.5rem;display:none;" role="alert"></span>
+        {% endif %}
+      </div>
+      {% endif %}
     </div>
   </div>
 
@@ -750,6 +784,7 @@
           delete_confirm: {{ _("annotations.delete_confirm") | tojson }},
           page: {{ _("annotations.page") | tojson }},
           color: {{ _("annotations.color") | tojson }},
+          go_to_page: {{ _("annotations.go_to_page") | tojson }},
           type_note: {{ _("annotations.type_note") | tojson }},
           type_highlight: {{ _("annotations.type_highlight") | tojson }},
           type_underline: {{ _("annotations.type_underline") | tojson }},
@@ -801,18 +836,110 @@
 
   const viewerEl = document.getElementById('embedpdf-viewer');
   if (viewerEl) {
+    const fileId = {{ file.id | tojson }};
     {% if processed_file_exists %}
-    const pdfUrl = '/api/files/{{ file.id }}/preview?version=processed';
+    const pdfUrl = '/api/files/' + fileId + '/preview?version=processed';
     {% else %}
-    const pdfUrl = '/api/files/{{ file.id }}/preview?version=original';
+    const pdfUrl = '/api/files/' + fileId + '/preview?version=original';
     {% endif %}
 
-    EmbedPDF.init({
+    const viewer = EmbedPDF.init({
       type: 'container',
       target: viewerEl,
       src: pdfUrl,
     });
+
+    if (viewer) {
+      viewer.registry.then(function (registry) {
+        // ── Page sync: viewer page change → update annotation form ──────────
+        var scrollPlugin = registry.getPlugin('scroll');
+        if (scrollPlugin) {
+          var scroll = scrollPlugin.provides();
+          scroll.onPageChange(function (event) {
+            var pageInput = document.getElementById('annotation-page-input');
+            if (pageInput) {
+              pageInput.value = String(event.pageNumber);
+            }
+          });
+          // Expose scrollToPage so the annotations panel can navigate the viewer
+          window._embedpdfScrollToPage = function (pageNumber) {
+            scroll.scrollToPage({ pageNumber: pageNumber });
+          };
+        }
+
+        // ── Auto-save: viewer annotation events → DocuElevate API ───────────
+        var annotationPlugin = registry.getPlugin('annotation');
+        if (annotationPlugin) {
+          var annotation = annotationPlugin.provides();
+          annotation.onAnnotationEvent(function (event) {
+            if (event.type !== 'create') return;
+            var ann = event.annotation;
+            var pageIndex = typeof ann.pageIndex === 'number' ? ann.pageIndex
+              : (typeof event.pageIndex === 'number' ? event.pageIndex : 0);
+            var page = pageIndex + 1;
+            var rect = ann.rect || { x: 0, y: 0, width: 0, height: 0 };
+            var color = ann.strokeColor || ann.color || undefined;
+            var content = (ann.contents || '').trim();
+            // Map PDF annotation subtypes to DocuElevate annotation types
+            var typeMap = {
+              highlight: 'highlight',
+              underline: 'underline',
+              strikeout: 'strikethrough',
+              squiggly: 'underline',
+              text: 'note',
+              freetext: 'note',
+              ink: 'note',
+              square: 'note',
+              circle: 'note',
+            };
+            var annType = typeMap[String(ann.type).toLowerCase()] || 'note';
+            if (!content) {
+              var typeLabel = annType.charAt(0).toUpperCase() + annType.slice(1);
+              content = typeLabel + ' \u2014 p.' + page;
+            }
+            var payload = {
+              page: page,
+              x: rect.x || 0,
+              y: rect.y || 0,
+              width: rect.width || 0,
+              height: rect.height || 0,
+              annotation_type: annType,
+              content: content,
+            };
+            if (color) {
+              payload.color = color;
+            }
+            fetch('/api/files/' + fileId + '/annotations', {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify(payload),
+            })
+              .then(function (r) {
+                if (r.ok && typeof window._reloadAnnotations === 'function') {
+                  window._reloadAnnotations();
+                }
+              })
+              .catch(function (err) {
+                console.error('Failed to save viewer annotation:', err);
+              });
+          });
+        }
+      }).catch(function () {});
+    }
   }
 </script>
 {% endif %}
+{% if multi_user_enabled and file and file.owner_id is none %}
+<script src="{{ url_for('static', path='js/claim.js') }}" defer></script>
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+  initClaimOwnership({{ file.id | tojson }}, {
+    confirm: {{ _("file.claim_ownership_confirm") | tojson }},
+    success: {{ _("file.claim_ownership_success") | tojson }},
+    failed:  {{ _("file.claim_ownership_failed") | tojson }}
+  });
+});
+</script>
+{% endif %}
 {% endblock %}
+

frontend/templates/file_detail.html

@@ -1056,7 +1056,7 @@
 
           html += `
             <div role="listitem">
-            <a href="/files/${doc.file_id}" aria-label="${title} — ${scorePercent}% similarity (${scoreLabel})" style="text-decoration: none; color: inherit; display: block;">
+            <a href="/files/${doc.file_id}/detail" aria-label="${title} — ${scorePercent}% similarity (${scoreLabel})" style="text-decoration: none; color: inherit; display: block;">
               <div style="display: flex; align-items: center; gap: 1rem; padding: 0.75rem 1rem; background-color: #f7fafc; border-radius: 0.5rem; border: 1px solid #e2e8f0; transition: border-color 0.2s; cursor: pointer;" onmouseover="this.style.borderColor='#4299e1'" onmouseout="this.style.borderColor='#e2e8f0'">
                 <div style="flex-shrink: 0; width: 48px; height: 48px; border-radius: 50%; display: flex; align-items: center; justify-content: center; font-weight: 700; font-size: 0.875rem; color: white; background-color: ${scorePercent >= 80 ? '#48bb78' : scorePercent >= 50 ? '#ecc94b' : '#718096'};" aria-hidden="true">
                   ${scorePercent}%
@@ -1091,20 +1091,19 @@
     }
   </script>
   {% endif %}
-
 {% endblock %}
 
 {% block content %}
 <div class="detail-container">
   <div style="display:flex;align-items:center;gap:1rem;margin-bottom:1.5rem;flex-wrap:wrap;">
-    <a href="/files/{{ file.id }}" class="back-button" style="margin-bottom:0;" aria-label="Back to File Summary">
+    <a href="/files" class="back-button" style="margin-bottom:0;" aria-label="Back to File List">
       <i class="fas fa-arrow-left" aria-hidden="true"></i>
-      Back to File Summary
+      Back to File List
     </a>
     {% if file %}
-    <a href="/files/{{ file.id }}/detail" class="back-button" style="margin-bottom:0;" aria-label="View document detail for {{ file.original_filename }}">
+    <a href="/files/{{ file.id }}" class="back-button" style="margin-bottom:0;" aria-label="View document for {{ file.original_filename }}">
       <i class="fas fa-eye" aria-hidden="true"></i>
-      Document Detail
+      View Document
     </a>
     {% endif %}
   </div>

frontend/templates/file_summary.html

@@ -165,6 +165,12 @@
     {% if file.document_title %}
     <div class="info-row"><span class="info-key">Document Title</span><span class="info-val">{{ file.document_title }}</span></div>
     {% endif %}
+    {% if multi_user_enabled %}
+    <div class="info-row">
+      <span class="info-key">{{ _("file.owner_label") }}</span>
+      <span class="info-val">{{ owner_display or _("file.owner_unowned") }}</span>
+    </div>
+    {% endif %}
   </div>
 
   <!-- ── Quick actions ── -->
@@ -184,7 +190,18 @@
       <a href="/files/{{ file.id }}/detail" class="action-btn btn-secondary">
         <i class="fas fa-eye" aria-hidden="true"></i> View Detail
       </a>
+      {% if multi_user_enabled and file.owner_id is none %}
+      <button
+        class="action-btn btn-primary"
+        id="claim-btn"
+        aria-label="{{ _('file.claim_ownership') }}"
+        style="background:#10b981;"
+      >
+        <i class="fas fa-user-check" aria-hidden="true"></i> {{ _("file.claim_ownership") }}
+      </button>
+      {% endif %}
     </div>
+    <p id="claim-msg" style="margin-top:0.5rem;font-size:0.875rem;display:none;" role="alert"></p>
   </div>
 
   {% else %}
@@ -193,4 +210,17 @@
   {% endif %}
 
 </div>
+
+{% if multi_user_enabled and file and file.owner_id is none %}
+<script src="{{ url_for('static', path='js/claim.js') }}" defer></script>
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+  initClaimOwnership({{ file.id | tojson }}, {
+    confirm: {{ _("file.claim_ownership_confirm") | tojson }},
+    success: {{ _("file.claim_ownership_success") | tojson }},
+    failed:  {{ _("file.claim_ownership_failed") | tojson }}
+  });
+});
+</script>
+{% endif %}
 {% endblock %}

frontend/templates/file_view.html

@@ -316,6 +316,12 @@
             {% endif %}
           </span>
         </div>
+        {% if multi_user_enabled %}
+        <div class="info-row">
+          <span class="info-key">{{ _("file.owner_label") }}</span>
+          <span class="info-val">{{ owner_display or _("file.owner_unowned") }}</span>
+        </div>
+        {% endif %}
       </div>
 
       <!-- Actions -->
@@ -344,7 +350,18 @@
           <a href="/shared-links?file_id={{ file.id }}" class="action-btn btn-secondary">
             <i class="fas fa-share-alt" aria-hidden="true"></i> Share
           </a>
+          {% if multi_user_enabled and file.owner_id is none %}
+          <button
+            class="action-btn btn-primary"
+            id="claim-btn"
+            aria-label="{{ _('file.claim_ownership') }}"
+            style="background:#10b981;border:none;cursor:pointer;"
+          >
+            <i class="fas fa-user-check" aria-hidden="true"></i> {{ _("file.claim_ownership") }}
+          </button>
+          {% endif %}
         </div>
+        <p id="claim-msg" style="margin-top:0.5rem;font-size:0.875rem;display:none;" role="alert"></p>
       </div>
     </div>
 
@@ -937,6 +954,16 @@
         pdfInit('/api/files/{{ file.id }}/preview?version={{ pv }}');
       {% endif %}
     {% endif %}
+    {% if multi_user_enabled and file and file.owner_id is none %}
+    initClaimOwnership({{ file.id | tojson }}, {
+      confirm: {{ _("file.claim_ownership_confirm") | tojson }},
+      success: {{ _("file.claim_ownership_success") | tojson }},
+      failed:  {{ _("file.claim_ownership_failed") | tojson }}
+    });
+    {% endif %}
   });
 </script>
+{% if multi_user_enabled and file and file.owner_id is none %}
+<script src="{{ url_for('static', path='js/claim.js') }}" defer></script>
+{% endif %}
 {% endblock %}

frontend/templates/files.html

@@ -1538,6 +1538,28 @@
         });
     }
 
+    function escapeHtml(str) {
+      if (!str) return '';
+      return String(str)
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+    }
+
+    function sanitizeHighlight(html) {
+      if (!html) return '';
+      let safe = String(html)
+        .replace(/<mark>/gi, '\x00MARK_OPEN\x00')
+        .replace(/<\/mark>/gi, '\x00MARK_CLOSE\x00');
+      safe = escapeHtml(safe);
+      safe = safe
+        .replace(/\x00MARK_OPEN\x00/g, '<mark>')
+        .replace(/\x00MARK_CLOSE\x00/g, '</mark>');
+      return safe;
+    }
+
     function renderSearchResults(data, q) {
       const panel = document.getElementById('search-results-panel');
       const list = document.getElementById('search-results-list');
@@ -1555,25 +1577,31 @@
 
       list.innerHTML = results.map(hit => {
         const fmt = hit._formatted || {};
-        const title = fmt.document_title || hit.document_title || hit.original_filename || __i18n.untitled;
+        const titleRaw = fmt.document_title || hit.document_title || hit.original_filename || __i18n.untitled;
-        const filename = fmt.original_filename || hit.original_filename || '';
+        const filenameRaw = fmt.original_filename || hit.original_filename || '';
-        const snippet = fmt.ocr_text || '';
+        const snippetRaw = fmt.ocr_text || '';
-        const tags = Array.isArray(hit.tags) ? hit.tags.join(', ') : (hit.tags || '');
+        const tagsRaw = Array.isArray(hit.tags) ? hit.tags.join(', ') : (hit.tags || '');
-        const docType = hit.document_type || '';
+        const docTypeRaw = hit.document_type || '';
+
+        const safeTitle = fmt.document_title ? sanitizeHighlight(titleRaw) : escapeHtml(titleRaw);
+        const safeFilename = escapeHtml(filenameRaw);
+        const safeSnippet = sanitizeHighlight(snippetRaw);
+        const safeTags = escapeHtml(tagsRaw);
+        const safeDocType = escapeHtml(docTypeRaw);
 
         return `<div style="padding: 0.75rem 1rem; border-bottom: 1px solid #f3f4f6; display: flex; gap: 0.75rem; align-items: flex-start;">
           <div style="flex-shrink: 0; color: #3b82f6; font-size: 1.25rem; padding-top: 0.1rem;">
             <i class="fas fa-file-pdf"></i>
           </div>
           <div style="flex: 1; min-width: 0;">
-            <div style="font-weight: 600; font-size: 0.9rem; color: #111827;">${title}</div>
+            <div style="font-weight: 600; font-size: 0.9rem; color: #111827;">${safeTitle}</div>
-            ${filename ? `<div style="font-size: 0.8rem; color: #6b7280; margin-top: 0.15rem;">${filename}</div>` : ''}
+            ${safeFilename ? `<div style="font-size: 0.8rem; color: #6b7280; margin-top: 0.15rem;">${safeFilename}</div>` : ''}
-            ${docType ? `<span style="display: inline-block; margin-top: 0.25rem; padding: 0.1rem 0.5rem; background: #eff6ff; color: #1d4ed8; border-radius: 9999px; font-size: 0.75rem;">${docType}</span>` : ''}
+            ${safeDocType ? `<span style="display: inline-block; margin-top: 0.25rem; padding: 0.1rem 0.5rem; background: #eff6ff; color: #1d4ed8; border-radius: 9999px; font-size: 0.75rem;">${safeDocType}</span>` : ''}
-            ${tags ? `<span style="display: inline-block; margin-top: 0.25rem; margin-left: 0.25rem; padding: 0.1rem 0.5rem; background: #f0fdf4; color: #15803d; border-radius: 9999px; font-size: 0.75rem;">${tags}</span>` : ''}
+            ${safeTags ? `<span style="display: inline-block; margin-top: 0.25rem; margin-left: 0.25rem; padding: 0.1rem 0.5rem; background: #f0fdf4; color: #15803d; border-radius: 9999px; font-size: 0.75rem;">${safeTags}</span>` : ''}
-            ${snippet ? `<div style="margin-top: 0.4rem; font-size: 0.8rem; color: #374151; white-space: pre-wrap; word-break: break-word;">…${snippet}…</div>` : ''}
+            ${safeSnippet ? `<div style="margin-top: 0.4rem; font-size: 0.8rem; color: #374151; white-space: pre-wrap; word-break: break-word;">…${safeSnippet}…</div>` : ''}
           </div>
           <div style="flex-shrink: 0;">
-            <a href="/files/${hit.file_id}" style="padding: 0.25rem 0.6rem; background: #f3f4f6; color: #374151; border-radius: 0.25rem; font-size: 0.8rem; text-decoration: none; white-space: nowrap;" title="${__i18n.viewFile}">
+            <a href="/files/${escapeHtml(hit.file_id)}" style="padding: 0.25rem 0.6rem; background: #f3f4f6; color: #374151; border-radius: 0.25rem; font-size: 0.8rem; text-decoration: none; white-space: nowrap;" title="${__i18n.viewFile}">
               <i class="fas fa-external-link-alt"></i>
             </a>
           </div>

frontend/templates/integrations_dashboard.html

@@ -1392,7 +1392,7 @@ function integrationsDashboard() {
           body: JSON.stringify({
             integration_type: intg.integration_type,
             config: intg.config,
-            credentials: creds.credentials,
+            credentials: creds,
           }),
         });
         const data = await resp.json();

frontend/templates/search.html

@@ -298,9 +298,13 @@
   }
 
   function escapeHtml(str) {
-    const d = document.createElement('div');
+    if (str === null || str === undefined) return '';
-    d.textContent = str;
+    return String(str)
-    return d.innerHTML;
+      .replace(/&/g, '&')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#039;');
   }
 
   /**

frontend/templates/signup.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>DocuElevate - Create Account</title>
-    <link href="https://cdn.jsdelivr.net/npm/tailwindcss@2.2.19/dist/tailwind.min.css" rel="stylesheet">
+    <link rel="stylesheet" href="/static/styles.css" />
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css"
           integrity="sha512-DTOQO9RWCH3ppGqcWaEA1BIZOC6xxalwEsw9c2QQeAIftl+Vegovlnee1c9QX4TctnWMn13TZye+giMm8e2LwA=="
           crossorigin="anonymous" referrerpolicy="no-referrer" />

frontend/templates/status_dashboard.html

@@ -393,6 +393,16 @@ const i18nStrings = {
   configureNow: {{ _("status.configure_now") | tojson }},
 };
 
+function escapeHtml(str) {
+  if (!str) return '';
+  return String(str)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#039;');
+}
+
 document.addEventListener('DOMContentLoaded', function() {
   // Modal elements
   const resultModal = document.getElementById('resultModal');
@@ -469,9 +479,8 @@ document.addEventListener('DOMContentLoaded', function() {
         const isSensitive = sensitiveKeys.some(sKey => key.toLowerCase().includes(sKey));
 
         if (isSensitive && value !== 'Not set' && value !== '') {
-          valueCell.textContent = value.slice(4) + '********' + value.slice(-4);
           // For better readability, we can also use HTML to mask the middle part of the string
-          valueCell.innerHTML = value.slice(0, 4) + '<span class="text-gray-400">********</span>' + value.slice(-4);
+          valueCell.innerHTML = escapeHtml(value.slice(0, 4)) + '<span class="text-gray-400">********</span>' + escapeHtml(value.slice(-4));
         } else {
           valueCell.textContent = value;
         }
@@ -586,9 +595,9 @@ document.addEventListener('DOMContentLoaded', function() {
           if (data.status === 'success') {
             // If there's token info, we need to handle it specially
             if (data.token_info && data.token_info.expires_in_human) {
-              let message = data.message || 'Connection successful';
+              let message = escapeHtml(data.message || 'Connection successful');
               message += `<br><br><div class="bg-blue-50 p-3 rounded mt-2">
-                <span class="font-medium">${i18nStrings.tokenValidFor}</span> ${data.token_info.expires_in_human}
+                <span class="font-medium">${i18nStrings.tokenValidFor}</span> ${escapeHtml(data.token_info.expires_in_human)}
                 </div>`;
 
               modalTitle.textContent = i18nStrings.testSuccessful;
@@ -647,12 +656,12 @@ document.addEventListener('DOMContentLoaded', function() {
         .then(data => {
           if (data.status === 'success') {
             // Create successful message
-            let message = data.message || 'Connection successful';
+            let message = escapeHtml(data.message || 'Connection successful');
 
             // Add token expiration info if available (especially for Google Drive)
             if (data.token_info && data.token_info.expires_in_human) {
               message += `<br><br><div class="bg-blue-50 p-3 rounded mt-2">
-                <span class="font-medium">${i18nStrings.tokenValidFor}</span> ${data.token_info.expires_in_human}
+                <span class="font-medium">${i18nStrings.tokenValidFor}</span> ${escapeHtml(data.token_info.expires_in_human)}
                 </div>`;
 
               // Show the message with HTML

frontend/translations/en.json

@@ -321,6 +321,7 @@
   "annotations.delete_confirm": "Are you sure you want to delete this annotation?",
   "annotations.deleted": "Annotation deleted",
   "annotations.empty": "No annotations yet",
+  "annotations.go_to_page": "Go to page",
   "annotations.heading": "Annotations",
   "annotations.page": "Page",
   "annotations.save": "Save",
@@ -1756,6 +1757,12 @@
   "sharing.role_viewer": "Viewer",
   "sharing.user_id_label": "User ID or email",
   "sharing.user_id_placeholder": "e.g. alice@example.com",
+  "file.owner_label": "Owner",
+  "file.owner_unowned": "Unowned",
+  "file.claim_ownership": "Claim Ownership",
+  "file.claim_ownership_confirm": "Claim this document as yours? You will become the owner and can manage sharing.",
+  "file.claim_ownership_success": "You are now the owner of this document.",
+  "file.claim_ownership_failed": "Could not claim ownership. The document may already have an owner.",
   "similarity.backfill_auto": "The background task will compute them automatically every 5 minutes, or you can",
   "similarity.files_missing_text": "file(s) have OCR text but no embedding yet.",
   "similarity.find_pairs_btn": "Find Pairs",

helm/docuelevate/templates/beat-deployment.yaml

@@ -1,83 +0,0 @@
-{{- /*
-  Celery Beat scheduler — publishes periodic tasks to the broker.
-  Exactly ONE replica must run; never scale this deployment.
-*/ -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "docuelevate.fullname" . }}-beat
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "docuelevate.labels" . | nindent 4 }}
-    app.kubernetes.io/component: beat
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate          # Prevent two Beat instances from running simultaneously
-  selector:
-    matchLabels:
-      {{- include "docuelevate.selectorLabels" . | nindent 6 }}
-      app.kubernetes.io/component: beat
-  template:
-    metadata:
-      labels:
-        {{- include "docuelevate.selectorLabels" . | nindent 8 }}
-        app.kubernetes.io/component: beat
-      {{- with .Values.beat.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-    spec:
-      serviceAccountName: {{ include "docuelevate.serviceAccountName" . }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.beat.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: beat
-          image: {{ include "docuelevate.image" . }}
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          command:
-            - celery
-            - -A
-            - app.celery_worker
-            - beat
-            - --loglevel=info
-          envFrom:
-            - configMapRef:
-                name: {{ include "docuelevate.fullname" . }}-config
-            - secretRef:
-                name: {{ include "docuelevate.fullname" . }}-secret
-          {{- with .Values.beat.securityContext }}
-          securityContext:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          resources:
-            {{- toYaml .Values.beat.resources | nindent 12 }}
-          volumeMounts:
-            - name: workdir
-              mountPath: /workdir
-      volumes:
-        - name: workdir
-          {{- if .Values.workdir.persistence.enabled }}
-          persistentVolumeClaim:
-            claimName: {{ .Values.workdir.persistence.existingClaim | default (printf "%s-workdir" (include "docuelevate.fullname" .)) }}
-          {{- else }}
-          emptyDir: {}
-          {{- end }}
-      {{- with .Values.beat.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.beat.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.beat.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}

helm/docuelevate/templates/worker-deployment.yaml

@@ -42,6 +42,7 @@ spec:
             - -A
             - app.celery_worker
             - worker
+            - -B
             - --loglevel=info
             - -Q
             - document_processor,default,celery

helm/docuelevate/values.yaml

@@ -121,10 +121,10 @@ api:
     type: ClusterIP
     port: 8000
 
-  # Liveness / readiness probes (unauthenticated endpoints for kubelet)
+  # Liveness / readiness probes
   livenessProbe:
     httpGet:
-      path: /api/diagnostic/healthz/live
+      path: /api/health
       port: 8000
     initialDelaySeconds: 30
     periodSeconds: 20
@@ -132,7 +132,7 @@ api:
 
   readinessProbe:
     httpGet:
-      path: /api/diagnostic/healthz/ready
+      path: /api/health
       port: 8000
     initialDelaySeconds: 15
     periodSeconds: 10
@@ -191,36 +191,7 @@ worker:
       drop: ["ALL"]
 
 # ---------------------------------------------------------------------------
-# Celery Beat scheduler (singleton — always exactly 1 replica)
+# Shared workdir volume (api + worker mount the same PVC)
-# Beat publishes periodic tasks; workers consume them from the broker.
-# ---------------------------------------------------------------------------
-beat:
-  resources:
-    requests:
-      cpu: 100m
-      memory: 256Mi
-    limits:
-      cpu: 500m
-      memory: 512Mi
-
-  podAnnotations: {}
-  nodeSelector: {}
-  tolerations: []
-  affinity: {}
-
-  podSecurityContext:
-    runAsNonRoot: true
-    runAsUser: 1000
-    fsGroup: 1000
-
-  securityContext:
-    allowPrivilegeEscalation: false
-    readOnlyRootFilesystem: false
-    capabilities:
-      drop: ["ALL"]
-
-# ---------------------------------------------------------------------------
-# Shared workdir volume (api + worker + beat mount the same PVC)
 # ---------------------------------------------------------------------------
 workdir:
   persistence:

main_base.py

@@ -0,0 +1,201 @@
+"""
+Base setup for views, containing shared functionality and imports.
+"""
+
+import logging
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, HTTPException, Request  # noqa: F401
+from fastapi.templating import Jinja2Templates
+from sqlalchemy.orm import Session  # noqa: F401
+
+from app.auth import require_login  # noqa: F401
+from app.config import settings
+from app.database import SessionLocal, get_db  # noqa: F401
+from app.models import UserProfile
+from app.utils.i18n import (
+    SUPPORTED_LANGUAGES,
+    detect_language,
+    format_date,
+    format_datetime,
+    format_number,
+    get_suggested_languages,
+    translate,
+)
+
+# Set up Jinja2 templates
+templates_dir = Path(__file__).parent.parent.parent / "frontend" / "templates"
+templates = Jinja2Templates(directory=str(templates_dir))
+
+# Add Python built-in functions to Jinja2 template globals
+templates.env.globals["min"] = min
+templates.env.globals["max"] = max
+
+# ---------------------------------------------------------------------------
+# i18n Jinja2 integration
+# ---------------------------------------------------------------------------
+# The _() function is available in every template to translate UI strings.
+# Usage: {{ _("nav.dashboard") }} or {{ _("upload.max_size", size="10 MB") }}
+# The locale is automatically resolved from the request context.
+# A default English implementation is registered as a global so error handlers
+# that don't go through _inject_global_context still have the function available.
+# ---------------------------------------------------------------------------
+
+templates.env.globals["supported_languages"] = SUPPORTED_LANGUAGES
+templates.env.globals["_"] = lambda key, **kwargs: translate(key, "en", **kwargs)
+
+# Customize Jinja2Templates to include app_version in all templates
+original_template_response = templates.TemplateResponse
+
+
+def _hydrate_language_from_db(request: Request, session_user: object) -> None:
+    """Load the user's preferred language from the DB into the session.
+
+    Called once per session when ``preferred_language`` is not yet in the
+    session.  A lightweight DB query fetches the stored preference so that
+    :func:`detect_language` picks it up from the session on all subsequent
+    requests without further DB access.
+    """
+    from app.utils.i18n import SUPPORTED_LANGUAGE_CODES
+
+    user_id: str | None = None
+    if isinstance(session_user, dict):
+        user_id = (
+            session_user.get("sub")
+            or session_user.get("preferred_username")
+            or session_user.get("email")
+            or session_user.get("id")
+        )
+    elif isinstance(session_user, str):
+        user_id = session_user
+
+    if not user_id:
+        return
+
+    db = SessionLocal()
+    try:
+        profile = db.query(UserProfile).filter(UserProfile.user_id == user_id).first()
+        if profile and profile.preferred_language and profile.preferred_language in SUPPORTED_LANGUAGE_CODES:
+            request.session["preferred_language"] = profile.preferred_language
+    except Exception:  # noqa: BLE001 — intentionally broad; DB may be temporarily unavailable
+        logger.debug("Could not hydrate language preference for user_id=%s", user_id)
+    finally:
+        db.close()
+
+
+def _inject_global_context(ctx: dict) -> None:
+    """Inject shared global variables into every template context dict."""
+    ctx.setdefault("version", settings.version)
+    ctx.setdefault("release_name", getattr(settings, "release_name", None))
+    ctx.setdefault("ui_default_color_scheme", getattr(settings, "ui_default_color_scheme", "system"))
+    ctx.setdefault("multi_user_enabled", getattr(settings, "multi_user_enabled", False))
+    ctx.setdefault("auth_enabled", getattr(settings, "auth_enabled", True))
+    ctx.setdefault(
+        "allow_signup",
+        getattr(settings, "multi_user_enabled", False) and getattr(settings, "allow_local_signup", False),
+    )
+    ctx.setdefault("enable_factory_reset", getattr(settings, "enable_factory_reset", False))
+
+    # Sentry Browser SDK config (injected into every page so the JS SDK can initialise)
+    # Normalize empty-string DSN to None so the {% if sentry_dsn %} template guard works correctly.
+    _raw_dsn = getattr(settings, "sentry_dsn", None)
+    ctx.setdefault("sentry_dsn", _raw_dsn if _raw_dsn else None)
+    ctx.setdefault("sentry_environment", getattr(settings, "sentry_environment", "production"))
+    ctx.setdefault("sentry_js_traces_sample_rate", getattr(settings, "sentry_js_traces_sample_rate", 0.0))
+    ctx.setdefault(
+        "sentry_js_replay_session_sample_rate",
+        getattr(settings, "sentry_js_replay_session_sample_rate", 0.0),
+    )
+    ctx.setdefault(
+        "sentry_js_replay_on_error_sample_rate",
+        getattr(settings, "sentry_js_replay_on_error_sample_rate", 0.1),
+    )
+
+    req = ctx.get("request")
+    if req is not None:
+        # CSRF token
+        if hasattr(req, "state") and hasattr(req.state, "csrf_token"):
+            ctx.setdefault("csrf_token", req.state.csrf_token)
+        # Determine whether the current visitor is authenticated
+        session_user = None
+        if hasattr(req, "session"):
+            session_user = req.session.get("user")
+        # When auth is disabled every visitor is effectively "logged in"
+        ctx.setdefault("is_logged_in", not getattr(settings, "auth_enabled", True) or session_user is not None)
+
+        # --- Hydrate session language from DB (once per session) ---
+        # If the session doesn't have a preferred_language yet but the user
+        # is logged in, load the stored preference from the database so that
+        # detect_language() picks it up from the session on this and all
+        # subsequent requests.
+        if hasattr(req, "session") and "preferred_language" not in req.session and session_user is not None:
+            _hydrate_language_from_db(req, session_user)
+
+        # --- i18n: detect language and register template helpers ---
+        current_locale = detect_language(req)
+        ctx.setdefault("current_locale", current_locale)
+
+        # Smart language suggestions for the compact nav-bar dropdown (5-7 languages)
+        accept_header = req.headers.get("accept-language", "") if hasattr(req, "headers") else ""
+        ctx.setdefault("suggested_languages", get_suggested_languages(current_locale, accept_header))
+
+        def _translate(key: str, **kwargs: object) -> str:
+            return translate(key, current_locale, **kwargs)
+
+        def _format_date(value: object, short: bool = False) -> str:
+            return format_date(value, current_locale, short=short)  # type: ignore[arg-type]
+
+        def _format_datetime(value: object) -> str:
+            return format_datetime(value, current_locale)  # type: ignore[arg-type]
+
+        def _format_number(value: object) -> str:
+            return format_number(value, current_locale)  # type: ignore[arg-type]
+
+        ctx.setdefault("_", _translate)
+        ctx.setdefault("format_date_l10n", _format_date)
+        ctx.setdefault("format_datetime_l10n", _format_datetime)
+        ctx.setdefault("format_number_l10n", _format_number)
+    else:
+        ctx.setdefault("is_logged_in", not getattr(settings, "auth_enabled", True))
+        ctx.setdefault("current_locale", "en")
+        ctx.setdefault("_", lambda key, **kw: translate(key, "en", **kw))
+
+
+def template_response_with_version(*args, **kwargs):
+    """Wrapper for TemplateResponse to include version and CSRF token in all templates.
+
+    Handles both old-style and new-style Starlette TemplateResponse calls:
+      - Old-style (Starlette <1.0): TemplateResponse(name, {"request": req, ...}, ...)
+      - New-style (Starlette 1.0+): TemplateResponse(request, name, context={...}, ...)
+    """
+    if len(args) >= 1 and isinstance(args[0], str):
+        # Old-style call: first positional arg is the template name (string).
+        # Convert to new-style: (request, name, context=..., ...)
+        name = args[0]
+        if len(args) >= 2 and isinstance(args[1], dict):
+            context = args[1]
+            # Old-style may have status_code as 3rd positional arg
+            if len(args) >= 3 and "status_code" not in kwargs:
+                kwargs["status_code"] = args[2]
+        else:
+            context = kwargs.pop("context", {})
+        request_obj = context.pop("request", None)
+        if request_obj is not None:
+            context["request"] = request_obj
+        _inject_global_context(context)
+        if request_obj is not None:
+            return original_template_response(request_obj, name, context=context, **kwargs)
+        return original_template_response(name, context=context, **kwargs)
+
+    # New-style call: (request, name, context=..., ...)
+    if "context" in kwargs and isinstance(kwargs["context"], dict):
+        _inject_global_context(kwargs["context"])
+    elif len(args) >= 3 and isinstance(args[2], dict):
+        _inject_global_context(args[2])
+    return original_template_response(*args, **kwargs)
+
+
+templates.TemplateResponse = template_response_with_version
+
+# Set up logging
+logger = logging.getLogger(__name__)

mkdocs.yml

@@ -55,6 +55,7 @@ nav:
       - Google Drive: GoogleDriveSetup
       - OneDrive: OneDriveSetup
       - Amazon S3: AmazonS3Setup
+      - Evernote: EvernoteSetup
       - Authentication: AuthenticationSetup
       - Notifications: NotificationsSetup
   - Security:

mobile/package.json

@@ -58,6 +58,13 @@
     "eslint-config-expo": "~10.0.0",
     "typescript": "^5.3.0"
   },
+  "overrides": {
+    "postcss": "8.5.15",
+    "uuid": "11.1.1",
+    "brace-expansion@^1.1.7": "1.1.13",
+    "brace-expansion@^2.0.2": "2.1.0",
+    "brace-expansion@^5.0.2": "5.0.6"
+  },
   "engines": {
     "node": ">=20.19.4"
   },

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=45", "wheel"]
+requires = ["setuptools>=82.0.1", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]

reproduce.py

@@ -0,0 +1,34 @@
+import sys
+from unittest.mock import MagicMock
+from fastapi.templating import Jinja2Templates
+
+import os
+# We don't really need a real path, but let's mock it
+os.makedirs("templates", exist_ok=True)
+with open("templates/files.html", "w") as f:
+    f.write("Hello")
+
+templates = Jinja2Templates(directory="templates")
+original_template_response = templates.TemplateResponse
+
+def template_response_with_version(*args, **kwargs):
+    if len(args) == 2 and isinstance(args[0], str) and isinstance(args[1], dict):
+        context = args[1]
+        request = context.get("request")
+        if request is not None:
+            # THIS IS MY FIX
+            print("Running fix logic")
+            return original_template_response(request=request, name=args[0], context=context, **kwargs)
+
+    print("Running original fallback logic")
+    return original_template_response(*args, **kwargs)
+
+templates.TemplateResponse = template_response_with_version
+
+req = MagicMock()
+try:
+    templates.TemplateResponse("files.html", {"request": req})
+    print("SUCCESS")
+except Exception as e:
+    import traceback
+    traceback.print_exc()

reproduce2.py

@@ -0,0 +1,33 @@
+import sys
+from unittest.mock import MagicMock
+from fastapi.templating import Jinja2Templates
+
+import os
+os.makedirs("templates", exist_ok=True)
+with open("templates/files.html", "w") as f:
+    f.write("Hello")
+
+templates = Jinja2Templates(directory="templates")
+original_template_response = templates.TemplateResponse
+
+def template_response_with_version(*args, **kwargs):
+    if len(args) == 2 and isinstance(args[0], str) and isinstance(args[1], dict):
+        context = args[1]
+        request = context.get("request")
+        if request is not None:
+            # THIS IS MY FIX
+            print("Running fix logic")
+            return original_template_response(request=request, name=args[0], context=context, **kwargs)
+
+    print("Running original fallback logic", args, kwargs)
+    return original_template_response(*args, **kwargs)
+
+templates.TemplateResponse = template_response_with_version
+
+req = MagicMock()
+try:
+    templates.TemplateResponse(request=req, name="files.html", context={"request": req})
+    print("SUCCESS")
+except Exception as e:
+    import traceback
+    traceback.print_exc()

reproduce3.py

@@ -0,0 +1,33 @@
+import sys
+from unittest.mock import MagicMock
+from fastapi.templating import Jinja2Templates
+
+import os
+os.makedirs("templates", exist_ok=True)
+with open("templates/files.html", "w") as f:
+    f.write("Hello")
+
+templates = Jinja2Templates(directory="templates")
+original_template_response = templates.TemplateResponse
+
+def template_response_with_version(*args, **kwargs):
+    if len(args) == 2 and isinstance(args[0], str) and isinstance(args[1], dict):
+        context = args[1]
+        request = context.get("request")
+        if request is not None:
+            # THIS IS MY FIX
+            print("Running fix logic")
+            return original_template_response(request=request, name=args[0], context=context, **kwargs)
+
+    print("Running original fallback logic", args, kwargs)
+    return original_template_response(*args, **kwargs)
+
+templates.TemplateResponse = template_response_with_version
+
+req = MagicMock()
+try:
+    templates.TemplateResponse("files.html", {"request": req}, status_code=200)
+    print("SUCCESS")
+except Exception as e:
+    import traceback
+    traceback.print_exc()

reproduce4.py

@@ -0,0 +1,35 @@
+import sys
+from unittest.mock import MagicMock
+from fastapi.templating import Jinja2Templates
+
+import os
+os.makedirs("templates", exist_ok=True)
+with open("templates/files.html", "w") as f:
+    f.write("Hello")
+
+templates = Jinja2Templates(directory="templates")
+original_template_response = templates.TemplateResponse
+
+def template_response_with_version(*args, **kwargs):
+    print("ARGS:", args)
+    print("KWARGS:", kwargs)
+    if len(args) == 2 and isinstance(args[0], str) and isinstance(args[1], dict):
+        context = args[1]
+        request = context.get("request")
+        if request is not None:
+            # THIS IS MY FIX
+            print("Running fix logic")
+            return original_template_response(request=request, name=args[0], context=context, **kwargs)
+
+    print("Running original fallback logic", args, kwargs)
+    return original_template_response(*args, **kwargs)
+
+templates.TemplateResponse = template_response_with_version
+
+req = MagicMock()
+try:
+    templates.TemplateResponse("files.html", context={"request": req})
+    print("SUCCESS")
+except Exception as e:
+    import traceback
+    traceback.print_exc()

requirements-dev.txt

@@ -4,14 +4,14 @@
 # Testing
 pytest>=8.0.0
 pytest-cov>=4.1.0
-pytest-asyncio>=0.23.0
+pytest-asyncio>=1.4.0
 pytest-mock>=3.12.0
 pytest-timeout>=2.3.0  # Per-test timeout enforcement to prevent CI hangs
 httpx>=0.26.0  # For async test client
 testcontainers>=3.7.1  # For integration tests with real containers
 fpdf2>=2.8.0  # For generating test PDF documents in integration tests
 minio>=7.1.0  # For MinIO/S3 integration tests
-redis>=4.5.0  # For Redis integration tests
+redis>=8.0.0  # For Redis integration tests
 boto3>=1.26.0  # For S3 integration tests
 
 # Code quality
@@ -34,7 +34,7 @@ pip-audit>=2.7.0  # Dependency vulnerability scanning against OSV/PyPA advisory
 pre-commit>=3.6.0
 
 # License compliance
-pip-licenses==5.5.1  # For license compliance checking
+pip-licenses==5.5.5  # For license compliance checking
 
 # Release automation
 python-semantic-release>=9.0.0

requirements.txt

@@ -2,8 +2,9 @@ fastapi[all]  # Web framework with all extras
 uvicorn  # ASGI server
 celery  # Task queue
 redis  # Message broker for Celery
-sqlalchemy  # Database ORM
+sqlalchemy  # Database ORM
-pydantic  # Data validation
+psycopg[binary]>=3.2,<4.0  # PostgreSQL driver for HA database deployments
+pydantic  # Data validation
 cryptography>=41.0.0  # Encryption for sensitive settings in database
 openai  # GPT integration for metadata extraction
 pypdf>=3.9.0  # PDF processing for text extraction, metadata editing and rotation (upgraded from PyPDF2 to fix CVE-2023-36464)
@@ -37,6 +38,9 @@ paramiko>=3.4.0  # SSH/SFTP implementation for Python (LGPL license)
 # iCloud Drive
 pyicloud>=2.4.0  # Unofficial Apple iCloud API client (MIT license)
 
+# Evernote
+evernote3>=1.25.14  # Evernote Cloud API SDK for Python 3 (BSD license)
+
 # Safe XML parsing (protection against XML bomb / XXE attacks)
 defusedxml>=0.7.1
 
@@ -51,7 +55,7 @@ pytesseract>=0.3.10  # Python wrapper for Tesseract OCR
 pdf2image>=1.17.0  # Convert PDF pages to images (used by Tesseract and EasyOCR providers)
 ocrmypdf>=16.0.0,<18.0.0  # Post-processing: embeds searchable text layers into PDFs via Tesseract
 meilisearch>=0.31.0  # Full-text search engine client
-stripe>=7.0.0,<15.0.0  # Stripe billing SDK (MIT license)
+stripe>=7.0.0,<16.0.0  # Stripe billing SDK (MIT license)
 
 # Error and performance monitoring
 sentry-sdk[fastapi,celery,sqlalchemy]>=2.20.0,<3.0.0

templates/files.html

@@ -0,0 +1 @@
+Hello

tests/test_allowed_types.py

@@ -83,8 +83,6 @@ class TestGotenbergCoverageDocuments:
         ".tif",
         ".webp",
         ".svg",
-        ".heic",
-        ".heif",
     }
     _html_extensions = {".html", ".htm"}
     _markdown_extensions = {".md", ".markdown"}

tests/test_api_dropbox.py

@@ -267,6 +267,15 @@ class TestTestDropboxToken:
 class TestSaveDropboxSettings:
     """Tests for save_dropbox_settings endpoint."""
 
+    @pytest.fixture(autouse=True)
+    def _admin_override(self):
+        from app.api.dropbox import _require_admin
+        from app.main import app as fastapi_app
+
+        fastapi_app.dependency_overrides[_require_admin] = lambda: {"is_admin": True}
+        yield
+        fastapi_app.dependency_overrides.pop(_require_admin, None)
+
     @patch("app.api.dropbox.settings")
     def test_save_settings_env_not_found(self, mock_settings, client):
         """Test that missing .env file is non-fatal — DB write still succeeds."""

tests/test_api_google_drive_comprehensive.py

@@ -360,6 +360,15 @@ class TestFormatTimeRemaining:
 class TestSaveGoogleDriveSettings:
     """Tests for POST /google-drive/save-settings endpoint."""
 
+    @pytest.fixture(autouse=True)
+    def _admin_override(self):
+        from app.api.google_drive import _require_admin
+        from app.main import app as fastapi_app
+
+        fastapi_app.dependency_overrides[_require_admin] = lambda: {"is_admin": True}
+        yield
+        fastapi_app.dependency_overrides.pop(_require_admin, None)
+
     @patch("builtins.open", new_callable=mock_open, read_data="# Existing config\n")
     @patch("os.path.exists")
     @patch("os.path.dirname")
@@ -481,18 +490,17 @@ class TestSaveGoogleDriveSettings:
 
         assert response.status_code == 200
 
-    @patch("os.path.exists")
+    @patch("app.api.google_drive.os")
-    @patch("os.path.dirname")
     @patch("app.config.settings")
-    def test_save_settings_exception_handling(self, mock_settings, mock_dirname, mock_exists, client: TestClient):
+    def test_save_settings_exception_handling(self, mock_settings, mock_os, client: TestClient):
-        """Test exception handling in save settings."""
+        """Test that exceptions in .env write are non-fatal — DB write still succeeds."""
-        mock_exists.side_effect = Exception("Unexpected error")
+        mock_os.path.exists.side_effect = Exception("Unexpected error")
 
         response = client.post("/api/google-drive/save-settings", data={"refresh_token": "token", "use_oauth": "true"})
 
-        assert response.status_code == 500
+        # .env write exception is caught; endpoint succeeds via DB write
-        data = response.json()
+        assert response.status_code == 200
-        assert "failed to save" in data["detail"].lower()
+        assert response.json()["status"] == "success"
 
 
 @pytest.mark.unit

tests/test_api_google_drive_coverage.py

@@ -195,6 +195,15 @@ class TestGetGoogleDriveTokenInfo:
 class TestSaveGoogleDriveSettings:
     """Test save_google_drive_settings endpoint edge cases."""
 
+    @pytest.fixture(autouse=True)
+    def _admin_override(self):
+        from app.api.google_drive import _require_admin
+        from app.main import app as fastapi_app
+
+        fastapi_app.dependency_overrides[_require_admin] = lambda: {"is_admin": True}
+        yield
+        fastapi_app.dependency_overrides.pop(_require_admin, None)
+
     @patch("app.api.google_drive.settings")
     @patch("os.path.exists")
     def test_save_settings_env_file_not_exists(self, mock_exists, mock_settings, client: TestClient):

tests/test_api_google_drive_final.py

@@ -152,11 +152,16 @@ class TestGetTokenInfoCredentialsBranches:
 
 @pytest.mark.unit
 class TestSaveGoogleDriveSettingsFalsyFields:
-    """Cover branches 395->397, 449->451, 468->470 in save_google_drive_settings.
+    """Cover branches 395->397, 449->451, 468->470 in save_google_drive_settings."""
 
-    Note: the Google Drive save endpoint is named save_google_drive_settings in the
+    @pytest.fixture(autouse=True)
-    source (app/api/google_drive.py).
+    def _admin_override(self):
-    """
+        from app.api.google_drive import _require_admin
+        from app.main import app as fastapi_app
+
+        fastapi_app.dependency_overrides[_require_admin] = lambda: {"is_admin": True}
+        yield
+        fastapi_app.dependency_overrides.pop(_require_admin, None)
 
     @patch("app.api.google_drive.settings")
     @patch("os.path.exists", return_value=False)
@@ -177,6 +182,7 @@ class TestSaveGoogleDriveSettingsFalsyFields:
             with patch("app.api.google_drive.notify_settings_updated"):
                 result = await save_google_drive_settings(
                     request=mock_request,
+                    _admin={"is_admin": True},
                     refresh_token="",  # falsy → branches 395->397 and 449->451
                     client_id="cid",
                     client_secret=None,