From 64e963c0aba6d78fe4a65d73ff8f9df95493547b Mon Sep 17 00:00:00 2001
From: stumpylog <797416+stumpylog@users.noreply.github.com>
Date: Sun, 2 Aug 2026 20:14:08 -0700
Subject: [PATCH] test: verify document is actually soft-deleted (not
 hard-deleted) in soft-delete visibility test

Addresses Copilot review feedback on PR #13505: refresh_from_db() and
assert deleted_at is set before checking visibility, so this test
actually validates the deleted_at__isnull=True filtering behavior
rather than just checking the document disappeared from the queryset
for any reason.
---
 src/documents/tests/test_permission_filtering_security.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/documents/tests/test_permission_filtering_security.py b/src/documents/tests/test_permission_filtering_security.py
index ce05cda0b..aae36f563 100644
--- a/src/documents/tests/test_permission_filtering_security.py
+++ b/src/documents/tests/test_permission_filtering_security.py
@@ -92,6 +92,11 @@ class TestPermittedDocumentIdsSecurity:
         owner = User.objects.create_user(username="owner")
         doc = DocumentFactory(owner=owner)
         doc.delete()  # soft delete
+        doc.refresh_from_db()
+        assert doc.deleted_at is not None, (
+            "document should be soft-deleted, not hard-deleted, for this "
+            "test to actually validate the deleted_at filtering behavior"
+        )
 
         assert_visible_document_ids(
             permitted_document_ids(owner),