fix(benchmark): fully clear users/groups on reset, grant perf_target model perms

src/paperless_benchmark/db.py

@@ -30,17 +30,19 @@ def _reset_table_names() -> list[str]:
     ]
 
 
-def _delete_non_superusers() -> None:
+def _delete_all_users_and_groups() -> None:
     from django.contrib.auth import get_user_model
+    from django.contrib.auth.models import Group
 
-    get_user_model().objects.filter(is_superuser=False).delete()
+    get_user_model().objects.all().delete()
+    Group.objects.all().delete()
 
 
 def _reset_postgresql() -> None:
     tables = _reset_table_names()
     with connection.cursor() as cursor:
         cursor.execute(f"TRUNCATE TABLE {', '.join(tables)} RESTART IDENTITY CASCADE;")
-    _delete_non_superusers()
+    _delete_all_users_and_groups()
 
 
 def _reset_mariadb() -> None:
@@ -55,7 +57,7 @@ def _reset_mariadb() -> None:
                 cursor.execute(f"TRUNCATE TABLE {table};")
         finally:
             cursor.execute("SET FOREIGN_KEY_CHECKS = 1;")
-    _delete_non_superusers()
+    _delete_all_users_and_groups()
 
 
 def _reset_sqlite() -> None:
@@ -70,14 +72,14 @@ def _reset_sqlite() -> None:
     Correspondent.objects.all().delete()
     DocumentType.objects.all().delete()
     StoragePath.objects.all().delete()
-    _delete_non_superusers()
+    _delete_all_users_and_groups()
 
 
 def reset_benchmark_data() -> None:
     """
     Remove all previously-seeded benchmark data (documents, tags,
     correspondents, document types, storage paths, guardian permission
-    rows, and non-superuser users) so a fresh `benchmark seed` run starts
+    rows, users, and groups) so a fresh `benchmark seed` run starts
     from an empty slate. Dispatches per-backend because TRUNCATE syntax
     and cascade behavior differ across the 3 supported databases.
     """

src/paperless_benchmark/seeding.py

@@ -113,12 +113,40 @@ class SeededData:
     storage_paths: tuple[StoragePath, ...]
 
 
+def _grant_model_level_permissions(user) -> None:
+    """
+    Grant perf_target Django model-level view/add/change permissions on
+    Document and Tag, on top of the per-object guardian grants seeding
+    creates elsewhere. DRF's PaperlessObjectPermissions checks model-level
+    permissions before guardian's object-level ones are ever consulted, so
+    without this perf_target gets a blanket 403 on /api/documents/ and
+    /api/tags/ regardless of which documents guardian says it can see.
+    """
+    from django.contrib.auth.models import Permission
+    from django.contrib.contenttypes.models import ContentType
+
+    from documents.models import Document
+    from documents.models import Tag
+
+    for model in (Document, Tag):
+        content_type = ContentType.objects.get_for_model(model)
+        codenames = [
+            f"{action}_{model._meta.model_name}" for action in ("view", "add", "change")
+        ]
+        perms = Permission.objects.filter(
+            content_type=content_type,
+            codename__in=codenames,
+        )
+        user.user_permissions.add(*perms)
+
+
 def _create_users_and_groups(counts: _TierCounts):
     from django.contrib.auth.models import Group
 
     from documents.tests.factories import UserFactory
 
     perf_target = UserFactory.create(username="perf_target")
+    _grant_model_level_permissions(perf_target)
     perf_admin = UserFactory.create(username="perf_admin", superuser=True)
     other_users = tuple(UserFactory.create_batch(counts.other_users))
     groups = tuple(