typing: graduate tests.permissioning.* subpackage out of the mypy baseline (#1768)

Continues the mypy baseline drain tracked in #1738 (the #1331 → #1335 → #1447
cadence). After the config tail (#1748), this is the next cohesive batch
called out in the issue: the 18-module ``opencontractserver.tests.permissioning.*``
subpackage. Removes all 18 ``[mypy-…]`` ``ignore_errors`` blocks from ``mypy.ini``,
prunes the corresponding 313 lines from ``docs/typing/mypy_baseline.txt``
(5592 → 5279), and fixes the 162 errors that surface.

Most errors were the standard Django ``setUpTestData(cls)`` class-attribute
pattern flagged by mypy (recommended fix from #1479: annotate the assigned
names as class-level attributes before the ``@classmethod`` body).

One real production-code gap surfaced:

- ``CoreAgent`` Protocol was missing its public ``config: AgentConfig``
  attribute (``opencontractserver/llms/agents/core_agents.py``). Five tests
  read ``agent.config.tools`` / ``agent.config._approval_bypass_allowed``
  directly off agents handed back by ``llm_agents.for_corpus(...)`` /
  ``for_document(...)``. The factory returns the ``CoreAgent`` Protocol;
  the concrete ``CoreAgentBase`` initialises ``self.config = config`` in
  ``__init__``, but the Protocol never declared it. Added ``config:
  AgentConfig`` to the Protocol body — captures the existing public API
  contract without a behaviour change.

Per-file test fixes:

- ``test_query_optimizer_methods.py`` (108 errors): added class-level
  annotations to ``AnalysisServicePermissionTestCase`` and
  ``DocumentPermissionFilterQueryCountTestCase`` covering every
  ``cls.<attr> = ...`` assignment inside ``setUpTestData``; switched
  ``User = get_user_model()`` to ``from opencontractserver.users.models
  import User`` so the name is usable as a type annotation; replaced three
  ``qs.first().<attr>`` accesses with ``qs[0].<attr>`` after the
  pre-existing ``qs.count() == 1`` guard.
- ``test_metadata_query_optimizer.py`` (15 errors): added ``assert status
  is not None`` narrowings before indexing into the ``dict | None`` return
  of ``MetadataService.get_metadata_completion_status``; one ``column is
  not None`` narrowing in ``test_validate_column_valid``.
- ``test_permissioning.py`` (10 errors): same ``setUpTestData`` annotation
  pattern on ``SetPermissionsIsNewTests``; same ``get_user_model()`` →
  direct import switch.
- ``test_permissioned_querysets.py`` (8 errors): narrowed
  ``qs.query.select_related`` (``dict | bool``) via ``assert isinstance(...,
  dict)`` before three ``assertIn`` calls; gave two ``PermissionQuerySet``
  constructions explicit type annotations.
- ``test_public_and_permissions.py`` (7 errors): removed six unused
  ``# type: ignore[attr-defined]`` comments on ``Model.objects.acount()``
  calls (django-stubs now ships proper async-manager typing).
- ``test_version_aware_query_optimizer.py`` (7 errors): replaced six
  ``result.first().id`` accesses with ``result[0].id`` after the
  pre-existing ``result.count() == 1`` guard.
- ``test_custom_permission_filters.py`` (4 errors): replaced two
  ``assertIsNotNone`` calls with ``assert`` narrowings.
- ``test_creator_based_permissions.py`` (2 errors): narrow
  ``# type: ignore[arg-type]`` on the two ``get_users_permissions_for_obj
  (instance=mock_instance, ...)`` calls (the test deliberately passes a
  non-``Model`` mock to exercise the no-guardian-tables fallback).
- ``test_comment_permission.py`` (1 error): replaced one ``assertIsNotNone``
  with ``assert`` for narrowing.

Pre-commit ``mypy`` continues to pass on the full project surface
(``mypy --config-file mypy.ini opencontractserver config`` → "Success: no
issues found in 1157 source files").

Refs #1738

Co-authored-by: Claude <noreply@anthropic.com>

Author: JSv4

CHANGELOG.md

@@ -58,6 +58,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **`DocumentKnowledgeBase` renders a mobile layout below 768px** (`frontend/src/components/knowledge_base/document/`). `DocumentKnowledgeBase` now renders `MobileDocumentLayout` below a 768px viewport width and the extracted `DesktopDocumentLayout` at or above it; desktop behavior is unchanged. The desktop floating components are now desktop-only — their dead `isMobile` branches were removed since the mobile layout no longer mounts them.
 
+- **Typing: graduated the `tests.permissioning.*` 18-module subpackage out of the mypy baseline** (issue #1738, continuing the #1331 → #1335 → #1447 cadence; the next batch after the `config.*` tail). Removed all 18 `[mypy-opencontractserver.tests.permissioning.*]` `ignore_errors` blocks from `mypy.ini`, pruned the corresponding 313 lines from `docs/typing/mypy_baseline.txt` (5592 → 5279), and fixed the 162 errors that surfaced. Pre-commit `mypy` continues to pass on the full project surface (`mypy --config-file mypy.ini opencontractserver config` → "Success: no issues found in 1157 source files"). Most errors were the standard Django `setUpTestData(cls)` class-attribute pattern flagged by mypy (recommended fix from #1479: annotate the assigned names as class-level attributes). One real production-code gap surfaced:
+  - **`CoreAgent` Protocol was missing its public `config: AgentConfig` attribute** (`opencontractserver/llms/agents/core_agents.py`). Five tests read `agent.config.tools` / `agent.config._approval_bypass_allowed` directly off agents handed back by `llm_agents.for_corpus(...)` / `for_document(...)`. The factory returns the `CoreAgent` Protocol; the concrete `CoreAgentBase` initializes `self.config = config` in `__init__`, but the Protocol never declared it. Tests worked at runtime (the attribute exists on every concrete agent) but failed type-checking. Added `config: AgentConfig` to the Protocol body — captures the existing public API contract without a behaviour change.
+  - **Per-file fixes (test side).** `test_query_optimizer_methods.py` (108 errors) — added class-level annotations to `AnalysisServicePermissionTestCase` and `DocumentPermissionFilterQueryCountTestCase` covering every `cls.<attr> = ...` assignment inside `setUpTestData`, switched `User = get_user_model()` to a direct `from opencontractserver.users.models import User` import so the name is usable as a type annotation, and replaced three `qs.first().<attr>` accesses with `qs[0].<attr>` after the pre-existing `qs.count() == 1` guard. `test_metadata_query_optimizer.py` (15 errors) — added `assert status is not None` narrowings before indexing into the `dict | None` return of `MetadataService.get_metadata_completion_status`, and a `column is not None` narrowing in `test_validate_column_valid`. `test_permissioning.py` (10 errors) — same `setUpTestData` annotation pattern on `SetPermissionsIsNewTests`, same `get_user_model()` → direct import switch. `test_permissioned_querysets.py` (8 errors) — narrowed `qs.query.select_related` (`dict | bool`) via `assert isinstance(..., dict)` before three `assertIn` calls, and gave two `PermissionQuerySet` constructions explicit type annotations so the generic queryset type is captured. `test_public_and_permissions.py` (7 errors) — removed six unused `# type: ignore[attr-defined]` comments on `Model.objects.acount()` calls (django-stubs now ships proper async-manager typing). `test_version_aware_query_optimizer.py` (7 errors) — replaced six `result.first().id` accesses with `result[0].id` after the pre-existing `result.count() == 1` guard. `test_custom_permission_filters.py` (4 errors) — replaced two `assertIsNotNone` calls with `assert` narrowings so mypy could see the subsequent `corpusN_edge["node"]...` was non-`None`. `test_creator_based_permissions.py` (2 errors) — narrow `# type: ignore[arg-type]` on the two `get_users_permissions_for_obj(instance=mock_instance, ...)` calls (the test deliberately passes a non-`Model` mock to exercise the no-guardian-tables fallback). `test_comment_permission.py` (1 error) — replaced one `assertIsNotNone` with `assert` for narrowing.
+
 - **Typing: graduated the `config.*` tail out of the mypy baseline** (issue #1738, continuing the #1331 → #1335 → #1447 cadence). Removed the five remaining `config.*` `[mypy-…]` `ignore_errors` blocks from `mypy.ini` — `config.settings.{base,local,test_integration}` and `config.websocket.consumers.{thread_updates,unified_agent_conversation}` — and pruned the corresponding 17 lines from `docs/typing/mypy_baseline.txt` (5611 → 5594). The entire `config.*` surface is now type-checked from scratch; only the `opencontractserver.*` test-suite modules, `opencontractserver.mcp.tests.test_mcp`, and the three intentional `django-manager-missing` model blocks remain on the baseline. Per-file fixes:
   - `config/settings/base.py`: annotated `SECURE_PERMISSIONS_POLICY: dict[str, list[str]]` and `PIPELINE_SETTINGS: dict[str, dict[str, Any]]` — both are literals (all-empty-list values / an empty dict) whose element types mypy cannot infer (`var-annotated`).
   - `config/settings/local.py`: moved `DEBUG = env.bool("DJANGO_DEBUG", False)` above the `if DEBUG and USE_SILK:` Silk-profiler gate. Besides clearing the `used-before-def` error this fixes a latent ordering bug — the gate previously read `base.py`'s star-imported `DEBUG` rather than the env-resolved value assigned a few lines below it. No behaviour change today (`USE_SILK` is hard-coded `False`), but the gate now consults the correct `DEBUG`.