perf: add database indexes, implement caching, enforce permission guards, and sanitize external URLs

paperless-backend/src/email/email-import.service.ts

@@ -44,20 +44,21 @@ export class EmailImportService {
       const hasPreview = await this.pageCache.hasPreview(attachment.Id, 1);
       if (!hasPreview && attachment.Content?.Content1) {
         this.logger.log(`Generiere fehlende Vorschaubilder für Anhang ${attachment.Id} (Email ${emailId})`);
+        const tempPdfPath = path.join(os.tmpdir(), `email-att-gen-${attachment.Id}.pdf`);
         try {
-          const tempPdfPath = path.join(os.tmpdir(), `email-att-gen-${attachment.Id}.pdf`);
           await fs.writeFile(tempPdfPath, attachment.Content.Content1);
-          
+
           const images = await this.pdfService.pdfToImages(tempPdfPath, 400);
           await this.pageCache.generate(attachment.Id, images);
-          
+
           attachment.PageCount = images.length;
           await this.attachmentRepo.save(attachment);
-          
+
           await this.pdfService.cleanup(images);
-          await fs.unlink(tempPdfPath).catch(() => {});
         } catch (err: any) {
           this.logger.warn(`Fehler bei on-demand Vorschau-Generierung für Anhang ${attachment.Id}: ${err.message}`);
+        } finally {
+          await fs.unlink(tempPdfPath).catch(() => {});
         }
       }
     }

paperless-backend/src/email/email.controller.ts

@@ -21,6 +21,7 @@ export class EmailController {
   ) {}
 
   @Get()
+  @RequirePermissions(Permission.VIEW_MAIL)
   async getEmails(
     @Query('status') status?: string,
     @Query('limit') limit?: string,
@@ -38,6 +39,7 @@ export class EmailController {
   }
 
   @Get(':id')
+  @RequirePermissions(Permission.VIEW_MAIL)
   async getEmail(@Param('id') id: string) {
     return this.emailRepo.findOneOrFail({
       where: { Id: parseInt(id, 10) },
@@ -46,6 +48,7 @@ export class EmailController {
   }
 
   @Get(':id/attachments')
+  @RequirePermissions(Permission.VIEW_MAIL)
   async getAttachments(@Param('id') id: string) {
     return this.attachmentRepo.find({
       where: { EmailMessageId: parseInt(id, 10) },
@@ -54,6 +57,7 @@ export class EmailController {
   }
 
   @Get('attachments/:attachmentId/content')
+  @RequirePermissions(Permission.VIEW_MAIL)
   async getAttachmentContent(
     @Param('attachmentId') attachmentId: string,
     @Res() res: Response,