Initial commit with Email Import Wizard and Task Processor updates

paperless-backend/src/auth/jwt-or-apikey.guard.ts

@@ -0,0 +1,31 @@
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { JwtAuthGuard } from './jwt-auth.guard';
+import { ApiKeyGuard } from './api-key.guard';
+import { lastValueFrom, isObservable } from 'rxjs';
+
+/**
+ * Combined guard that accepts either a valid JWT Bearer token
+ * or a valid API key (X-API-Key header / apiKey query param).
+ * Tries JWT first, falls back to API key.
+ */
+@Injectable()
+export class JwtOrApiKeyGuard implements CanActivate {
+  constructor(
+    private readonly jwtGuard: JwtAuthGuard,
+    private readonly apiKeyGuard: ApiKeyGuard,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    // Try JWT first
+    try {
+      const result = this.jwtGuard.canActivate(context);
+      const jwtOk = isObservable(result) ? await lastValueFrom(result) : await result;
+      if (jwtOk) return true;
+    } catch {
+      // JWT failed, try API key
+    }
+
+    // Fall back to API key
+    return this.apiKeyGuard.canActivate(context);
+  }
+}