fixes

backend/api/utils/auth.py

@@ -0,0 +1,26 @@
+"""Auth helpers for narrowing request.user to the concrete User type.
+
+DRF's `request.user` is typed as `User | AnonymousUser`. After a view enforces
+`IsAuthenticated`, the union is misleading: every code path past the permission
+check has the concrete user. These helpers express that narrowing for mypy and
+keep view bodies readable.
+"""
+
+from __future__ import annotations
+
+from rest_framework.exceptions import NotAuthenticated
+from rest_framework.request import Request
+
+from api.models import User
+
+
+def current_user(request: Request) -> User:
+    """Return the authenticated User for `request` or raise 401.
+
+    Use after `IsAuthenticated` permission. The check is defensive — the
+    permission class already rejected anonymous calls.
+    """
+    user = request.user
+    if not isinstance(user, User):
+        raise NotAuthenticated
+    return user