Address review: narrow user_id and auth header types, ClassVar codenames

Author: JSv4

config/admin_auth/backends.py

@@ -87,7 +87,7 @@ def authenticate(
             logger.warning("Auth0 admin auth failed: user %s not found", auth0_user_id)
             return None
 
-    def get_user(self, user_id: Any) -> Optional["User"]:
+    def get_user(self, user_id: int) -> Optional["User"]:
         """Retrieve user by primary key."""
         try:
             return UserModel.objects.get(pk=user_id)

config/graphql_api_token_auth/utils.py

@@ -18,7 +18,7 @@ def get_authorization_header(request: HttpRequest) -> bytes:
     coerce it to ``bytes`` here so downstream callers can treat the
     header uniformly (``.split()`` on ``bytes`` returns ``list[bytes]``).
     """
-    auth: Any = request.META.get("HTTP_AUTHORIZATION", b"")
+    auth: str | bytes = request.META.get("HTTP_AUTHORIZATION", b"")
     if isinstance(auth, str):
         # Work around django test client oddness
         auth = auth.encode(HTTP_HEADER_ENCODING)

opencontractserver/users/query_optimizer.py

@@ -4,7 +4,7 @@
 Provides optimized user queries with profile privacy filtering and corpus membership visibility.
 """
 
-from typing import TYPE_CHECKING, Optional, Union
+from typing import TYPE_CHECKING, ClassVar, Optional, Union
 
 from django.contrib.auth.models import AnonymousUser
 from django.db.models import Q, QuerySet
@@ -39,7 +39,7 @@ class UserQueryOptimizer:
     """
 
     # Permission codenames that indicate > READ access
-    WRITE_PERMISSION_CODENAMES: list[str] = [
+    WRITE_PERMISSION_CODENAMES: ClassVar[list[str]] = [
         "create_corpus",
         "update_corpus",
         "remove_corpus",