perf: add database indexes, implement caching, enforce permission guards, and sanitize external URLs

paperless-backend/src/postprocessing/postprocessing.service.ts

@@ -10,10 +10,14 @@ import { MailService } from './mail.service';
 import { ExportService } from './export.service';
 import axios from 'axios';
 
+const CACHE_TTL_MS = 5 * 60 * 1000;
+
 @Injectable()
 export class PostprocessingService {
   private readonly logger = new Logger(PostprocessingService.name);
   private readonly errorTagId: number;
+  private correspondentsCache: { data: any[]; expires: number } | null = null;
+  private documentTypesCache: { data: any[]; expires: number } | null = null;
 
   constructor(
     @InjectRepository(Postprocessing) private readonly ppRepo: Repository<Postprocessing>,
@@ -228,16 +232,31 @@ export class PostprocessingService {
     }
   }
 
+  private async getCachedCorrespondents(): Promise<any[]> {
+    if (!this.correspondentsCache || Date.now() > this.correspondentsCache.expires) {
+      const response = await this.paperlessService.getCorrespondents({ page_size: 9999 });
+      this.correspondentsCache = { data: response.results, expires: Date.now() + CACHE_TTL_MS };
+    }
+    return this.correspondentsCache.data;
+  }
+
+  private async getCachedDocumentTypes(): Promise<any[]> {
+    if (!this.documentTypesCache || Date.now() > this.documentTypesCache.expires) {
+      const data = await this.paperlessService.getDocumentTypes();
+      this.documentTypesCache = { data, expires: Date.now() + CACHE_TTL_MS };
+    }
+    return this.documentTypesCache.data;
+  }
+
   private async enrichDocWithNames(doc: any): Promise<void> {
     try {
       if (doc.correspondent && !doc._correspondentName) {
-        const response = await this.paperlessService.getCorrespondents({ page_size: 9999 });
-        const correspondents = response.results;
+        const correspondents = await this.getCachedCorrespondents();
         const c = correspondents.find((x: any) => x.id === doc.correspondent);
         doc._correspondentName = c?.name ?? '';
       }
       if (doc.document_type && !doc._documentTypeName) {
-        const docTypes = await this.paperlessService.getDocumentTypes();
+        const docTypes = await this.getCachedDocumentTypes();
         const dt = docTypes.find((x: any) => x.id === doc.document_type);
         doc._documentTypeName = dt?.name ?? '';
       }