From 80b1556942691f0aec43a59cf17f6c8c31af5947 Mon Sep 17 00:00:00 2001
From: stumpylog <797416+stumpylog@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:02:26 -0700
Subject: [PATCH] refactor: add type hints to permitted_object_ids and
 permitted_document_ids

Add missing type annotations to match the established conventions in this file
(see get_objects_for_user_owner_aware). Also added Model import from django.db.models.

- permitted_object_ids: user: User | None, model: type[Model], return -> QuerySet[int]
- permitted_document_ids: user: User | None, return -> QuerySet[int]

All 38 permission filtering security tests pass; this is a type-annotation-only change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UmMBGW9FKyDgmKRJ5H9rif
---
 src/documents/permissions.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/documents/permissions.py b/src/documents/permissions.py
index 2cc3a744c..c93c454b0 100644
--- a/src/documents/permissions.py
+++ b/src/documents/permissions.py
@@ -7,6 +7,7 @@ from django.contrib.contenttypes.models import ContentType
 from django.db.models import Case
 from django.db.models import Count
 from django.db.models import IntegerField
+from django.db.models import Model
 from django.db.models import Q
 from django.db.models import QuerySet
 from django.db.models import Value
@@ -164,12 +165,12 @@ def set_permissions_for_object(
 
 
 def permitted_object_ids(
-    user,
-    model,
+    user: User | None,
+    model: type[Model],
     perm: str,
     *,
     include_deleted: bool = False,
-):
+) -> QuerySet[int]:
     """
     Generic version of ``permitted_document_ids`` for any model with an
     ``owner`` field and guardian object-level permissions. ``include_deleted``
@@ -228,11 +229,11 @@ def permitted_object_ids(
 
 
 def permitted_document_ids(
-    user,
+    user: User | None,
     *,
     perm: str = "view_document",
     include_deleted: bool = False,
-):
+) -> QuerySet[int]:
     """
     Document-specific convenience wrapper around ``permitted_object_ids``.
     Return a queryset of document IDs the user has ``perm`` on (default