From df7d32c70cd4a36413189123283773d874b33c02 Mon Sep 17 00:00:00 2001
From: Miles <maxdeans@gmail.com>
Date: Mon, 1 Jun 2026 11:28:15 +0200
Subject: [PATCH] Require document privilege for PDF imports

---
 routes/document_routes.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/routes/document_routes.py b/routes/document_routes.py
index bae8bdb..34ef30d 100644
--- a/routes/document_routes.py
+++ b/routes/document_routes.py
@@ -146,7 +146,8 @@ def setup_document_routes(session_manager, upload_handler=None) -> APIRouter:
         from src.document_processor import _process_pdf
         import os
 
-        user = get_current_user(request)
+        from src.auth_helpers import require_privilege
+        user = require_privilege(request, "can_use_documents")
 
         # session_id is optional — a library import isn't tied to a chat. When
         # given, validate it; otherwise the PDF becomes a session-less library