Squash cms migrations to final state; DRY menus and test factories

First-pass consolidation before anything ships: 27 migrations across four
apps collapse to 6 that express only the end state — three regenerated
initials (authapi, content, datastore), authapi/0002_provision_roles (the
three groups and every grant), content/0002_provision_site (locales, index
pages, home rename, admin-approval workflow), and
content/0003_import_legacy_content (the reversible tiptap wrapper). The
galleries app is deleted outright — nothing needs its migration history
once the graph is rebuilt — along with the gallery_slug_choices stub kept
only for a serialized migration reference. The intermediate data
migrations (editor/reviewer consolidation, TeamMapGroup conversion,
gallerySlug folding) exist nowhere fresh installs can need them; the dev
database was rebooked with --fake and its stale galleries content-type
rows purged. The full test suite rebuilds the fresh chain every run.

DRY: GroupMenuItem moves to core/menu.py (moderation + content share it);
the per-module test factory copies (PASSWORD, make_user, make_admin_user,
make_team, make_portal, create_mirror_tables) consolidate into
core/testing.py; migration-number prose updated to the squashed names.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: nofurtherinformation

cms/authapi/migrations/0001_create_groups.py

@@ -0,0 +1,52 @@
+# Generated by Django 5.2.15 on 2026-08-06 22:47
+
+import django.db.models.deletion
+import modelcluster.fields
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('datastore', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Team',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=255, unique=True)),
+                ('slug', models.SlugField(help_text="Stable identifier, minted into members' JWT `teams` claim. Changing it revokes group_only gallery access until re-login.", max_length=255, unique=True)),
+            ],
+            options={
+                'ordering': ['name'],
+            },
+        ),
+        migrations.CreateModel(
+            name='TeamDistrictrMap',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('districtr_map', models.ForeignKey(db_constraint=False, on_delete=django.db.models.deletion.DO_NOTHING, related_name='team_links', to='datastore.districtrmap')),
+                ('team', modelcluster.fields.ParentalKey(on_delete=django.db.models.deletion.CASCADE, related_name='districtr_maps', to='authapi.team')),
+            ],
+            options={
+                'unique_together': {('team', 'districtr_map')},
+            },
+        ),
+        migrations.CreateModel(
+            name='TeamMembership',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('team', modelcluster.fields.ParentalKey(on_delete=django.db.models.deletion.CASCADE, related_name='memberships', to='authapi.team')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='team_memberships', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'unique_together': {('team', 'user')},
+            },
+        ),
+    ]

cms/authapi/migrations/0001_initial.py

@@ -0,0 +1,115 @@
+"""
+Provision the three roles (final state, squashed 2026-08-06 from the
+iterative authapi/content/datastore/galleries grant migrations of the
+first-pass branch — no deployment ever ran the intermediate states):
+
+- ``admin``: Wagtail admin access; full page permissions on the root
+  (add/change/publish/lock/unlock); every datastore model permission; the
+  Team-management model permissions.
+- ``partner``: admin access; root ``add_page`` only — own-content editing
+  via Wagtail's owner model, publishing via the admin-approval workflow
+  (content/0002). Comment moderation comes from scopes (authapi/scopes.py),
+  not Django permissions.
+- ``super_partner``: everything partner has, plus the map-module tool
+  permissions — DistrictrMap/Overlay/DistrictrMapOverlays add+change+view
+  and GerryDBTable view. GPKG import needs ``add_gerrydbtable``: admin only.
+
+Reverse deletes the groups (cascading their grants and page permissions).
+"""
+
+from django.db import migrations
+
+from core.migration_utils import ensure_permissions, model_permissions
+
+GROUPS = ["admin", "partner", "super_partner"]
+
+ADMIN_PAGE_PERMS = ["add_page", "change_page", "publish_page", "lock_page", "unlock_page"]
+PARTNER_PAGE_PERMS = ["add_page"]
+
+SUPER_PARTNER_DATASTORE_GRANTS = {
+    "districtrmap": ["add", "change", "view"],
+    "overlay": ["add", "change", "view"],
+    "districtrmapoverlays": ["add", "change", "view"],
+    "gerrydbtable": ["view"],
+}
+
+TEAM_MODELS = ["team", "teammembership", "teamdistrictrmap"]
+
+
+def _page_permissions(apps, codenames):
+    Permission = apps.get_model("auth", "Permission")
+    return Permission.objects.filter(
+        content_type__app_label="wagtailcore",
+        content_type__model="page",
+        codename__in=codenames,
+    )
+
+
+def provision_roles(apps, schema_editor):
+    # post_migrate hasn't fired on a fresh database: materialize the
+    # Permission rows this migration grants (core/migration_utils docs the
+    # footgun), including wagtailcore's custom publish/lock/unlock page perms.
+    for app_label in ("wagtailcore", "datastore", "authapi"):
+        ensure_permissions(app_label, apps, schema_editor)
+
+    Group = apps.get_model("auth", "Group")
+    Permission = apps.get_model("auth", "Permission")
+    Page = apps.get_model("wagtailcore", "Page")
+    GroupPagePermission = apps.get_model("wagtailcore", "GroupPagePermission")
+
+    groups = {name: Group.objects.get_or_create(name=name)[0] for name in GROUPS}
+
+    access_admin = Permission.objects.get(
+        content_type__app_label="wagtailadmin", codename="access_admin"
+    )
+    for group in groups.values():
+        group.permissions.add(access_admin)
+
+    # Page permissions are tree-scoped GroupPagePermission rows on the root
+    # (id=1, wagtailcore.0002_initial_data), NOT Django model permissions.
+    root = Page.objects.get(pk=1)
+    grants = {
+        "admin": ADMIN_PAGE_PERMS,
+        "partner": PARTNER_PAGE_PERMS,
+        "super_partner": PARTNER_PAGE_PERMS,
+    }
+    for name, codenames in grants.items():
+        for permission in _page_permissions(apps, codenames):
+            GroupPagePermission.objects.get_or_create(
+                group=groups[name], page=root, permission=permission
+            )
+
+    groups["admin"].permissions.add(*model_permissions(apps, "datastore"))
+    for model, actions in SUPER_PARTNER_DATASTORE_GRANTS.items():
+        groups["super_partner"].permissions.add(
+            *model_permissions(apps, "datastore", model=model).filter(
+                codename__in=[f"{action}_{model}" for action in actions]
+            )
+        )
+
+    for model in TEAM_MODELS:
+        groups["admin"].permissions.add(
+            *model_permissions(apps, "authapi", model=model)
+        )
+
+
+def remove_roles(apps, schema_editor):
+    Group = apps.get_model("auth", "Group")
+    Group.objects.filter(name__in=GROUPS).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("authapi", "0001_initial"),
+        ("datastore", "0001_initial"),
+        ("auth", "0012_alter_user_first_name_max_length"),
+        ("contenttypes", "0002_remove_content_type_name"),
+        ("wagtailadmin", "0001_create_admin_access_permissions"),
+        # 0002_initial_data for the root page; 0094 pins the modern
+        # GroupPagePermission shape (permission FK, not permission_type).
+        ("wagtailcore", "0094_alter_page_locale"),
+    ]
+
+    operations = [
+        migrations.RunPython(provision_roles, remove_roles),
+    ]