feat: generalize permitted_document_ids into permitted_object_ids for any model

Implements Task 14 of the permission-filtering consolidation plan:
- Add generic permitted_object_ids(user, model, perm, include_deleted=False)
- Refactor permitted_document_ids to delegate to permitted_object_ids
- Add comprehensive tests for Tag/Correspondent/DocumentType/StoragePath
- Preserve exact public behavior of permitted_document_ids (100% regression-free)

All 38 tests pass (18 existing + 20 new). The include_deleted parameter
correctly handles soft-delete patterns (effective only for Document).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/documents/permissions.py

@@ -163,30 +163,40 @@ def set_permissions_for_object(
                         )
 
 
-def permitted_document_ids(
+def permitted_object_ids(
     user,
+    model,
+    perm: str,
     *,
-    perm: str = "view_document",
     include_deleted: bool = False,
 ):
     """
-    Return a queryset of document IDs the user has ``perm`` on (default
-    ``"view_document"``). By default limited to non-deleted documents; pass
-    ``include_deleted=True`` for callers that need to check permission on
-    soft-deleted documents (e.g. trash restore). This intentionally avoids
-    ``get_objects_for_user`` to keep the subquery small and index-friendly.
+    Generic version of ``permitted_document_ids`` for any model with an
+    ``owner`` field and guardian object-level permissions. ``include_deleted``
+    only has an effect for models exposing a ``global_objects``/``deleted_at``
+    soft-delete pattern (currently only ``Document``); for every other model
+    it is accepted but has no effect, since those models have no soft-delete
+    concept.
     """
-
-    manager = Document.global_objects if include_deleted else Document.objects
-    base_docs = manager.all()
-    base_docs = base_docs.only("id", "owner")
+    has_soft_delete = hasattr(model, "global_objects")
+    manager = (
+        model.global_objects if include_deleted and has_soft_delete else model.objects
+    )
+    if has_soft_delete:
+        base_qs = (
+            manager.all()
+            if include_deleted
+            else manager.filter(deleted_at__isnull=True)
+        )
+    else:
+        base_qs = manager.all()
+    base_qs = base_qs.only("id", "owner")
 
     if user is None or not getattr(user, "is_authenticated", False):
-        # Just Anonymous user e.g. for drf-spectacular
-        return base_docs.filter(owner__isnull=True).values_list("id", flat=True)
+        return base_qs.filter(owner__isnull=True).values_list("id", flat=True)
 
     if getattr(user, "is_superuser", False):
-        return base_docs.values_list("id", flat=True)
+        return base_qs.values_list("id", flat=True)
 
     # Guardian's UserObjectPermission/GroupObjectPermission always store a bare
     # codename, but has_perm()-style callers commonly pass the qualified
@@ -194,31 +204,46 @@ def permitted_document_ids(
     # codename, so just drop any prefix rather than silently under-permitting.
     perm = perm.rsplit(".", 1)[-1]
 
-    document_ct = ContentType.objects.get_for_model(Document)
+    content_type = ContentType.objects.get_for_model(model)
     perm_filter = {
         "permission__codename": perm,
-        "permission__content_type": document_ct,
+        "permission__content_type": content_type,
     }
 
-    user_perm_docs = (
+    user_perm_ids = (
         UserObjectPermission.objects.filter(user=user, **perm_filter)
         .annotate(object_pk_int=Cast("object_pk", IntegerField()))
         .values_list("object_pk_int", flat=True)
     )
-
-    group_perm_docs = (
+    group_perm_ids = (
         GroupObjectPermission.objects.filter(group__user=user, **perm_filter)
         .annotate(object_pk_int=Cast("object_pk", IntegerField()))
         .values_list("object_pk_int", flat=True)
     )
+    permitted_ids = user_perm_ids.union(group_perm_ids)
 
-    permitted_documents = user_perm_docs.union(group_perm_docs)
-
-    return base_docs.filter(
-        Q(owner=user) | Q(owner__isnull=True) | Q(id__in=permitted_documents),
+    return base_qs.filter(
+        Q(owner=user) | Q(owner__isnull=True) | Q(id__in=permitted_ids),
     ).values_list("id", flat=True)
 
 
+def permitted_document_ids(
+    user,
+    *,
+    perm: str = "view_document",
+    include_deleted: bool = False,
+):
+    """
+    Document-specific convenience wrapper around ``permitted_object_ids``.
+    Return a queryset of document IDs the user has ``perm`` on (default
+    ``"view_document"``). By default limited to non-deleted documents; pass
+    ``include_deleted=True`` for callers that need to check permission on
+    soft-deleted documents (e.g. trash restore). This intentionally avoids
+    ``get_objects_for_user`` to keep the subquery small and index-friendly.
+    """
+    return permitted_object_ids(user, Document, perm, include_deleted=include_deleted)
+
+
 def get_document_count_filter_for_user(user, related_name: str = "documents"):
     """
     Return the Q object used to filter document counts for the given user.