Team scoping: close every unenumerated mutation path; API + form hardening

Review findings: scoping was enforced by enumerating dangerous views, and
Wagtail has more object-level endpoints than were enumerated — anything not
on the list defaulted to open.

- Pages: register before_unpublish/copy/move_page and before_bulk_action
  (bulk delete/publish/unpublish fire ONLY the bulk hook)
- Galleries: scoped Copy view (stock CopyView prefills via bare
  get_object_or_404 with an unrestricted map_group chooser) and the generic
  before_unpublish hook (UnpublishView checks only model-level publish)
- Datastore: History/Usage views get the same 404 guard as Inspect
- PlacePageForm no longer silently drops other teams' maps (or their curated
  order) from shared place pages
- content/galleries APIs: negative limit no longer 500s (shared clamped
  pagination in core/api.py); available_languages deduped
- Trim: TeamScopedViewSetMixin + instance_in_scope collapse the per-app
  scoping copies; 47-line Wagtail base.html copy replaced with a recursive
  same-name extends; dead Team.slug field removed; stale e2e endpoint removed
- Regression tests for each closed path (212 cms tests green)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: nofurtherinformation

app/e2e/utils/network-helpers.ts

@@ -18,7 +18,6 @@ export const API_ENDPOINTS = {
   patchUnshatter: '**/api/unshatter/*',
   root: '**/', // Returns {"message":"Hello World"}
   districtrMaps: '**/api/districtr_maps',
-  cmsContent: '**/api/cms/*',
 } as const;
 
 function globToRegExp(glob: string): RegExp {

cms/authapi/migrations/0006_remove_team_slug.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.15 on 2026-08-04 21:16
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('authapi', '0005_grant_admin_team_permissions'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='team',
+            name='slug',
+        ),
+    ]

cms/authapi/models.py

@@ -67,7 +67,6 @@ class Team(ClusterableModel):
     """
 
     name = models.CharField(max_length=255, unique=True)
-    slug = models.SlugField(max_length=255, unique=True)
 
     class Meta:
         ordering = ["name"]

cms/authapi/teams.py

@@ -17,6 +17,9 @@
 this module only answers "is this user scoped, and to which group slugs".
 """
 
+from functools import cached_property
+
+from django.http import Http404
 from wagtail.permission_policies.base import ModelPermissionPolicy
 
 from authapi.models import TeamMapGroup, TeamMembership
@@ -61,6 +64,14 @@ def districtr_map_slugs_for_user(user) -> set[str]:
     )
 
 
+def instance_in_scope(user, model, group_filter_field, pk) -> bool:
+    """False exactly when a team-scoped ``user`` may not act on ``model`` row
+    ``pk``. Unscoped users (admins, superusers, team-less) always pass."""
+    if not user_is_team_scoped(user):
+        return True
+    return scoped_queryset(model, group_filter_field, user).filter(pk=pk).exists()
+
+
 def scoped_queryset(model, group_filter_field, user):
     """``model`` rows whose MapGroup one of ``user``'s teams owns.
 
@@ -137,3 +148,40 @@ def user_has_permission_for_instance(self, user, action, instance):
                 .exists()
             )
         return super().user_has_permission_for_instance(user, action, instance)
+
+
+class TeamScopedViewSetMixin:
+    """SnippetViewSet mixin: index queryset and permission policy scoped to the
+    user's teams. Set ``group_filter_field``; override
+    ``permission_policy_class`` for view-grant behaviour."""
+
+    group_filter_field: str
+    permission_policy_class = TeamScopedModelPermissionPolicy
+
+    def get_queryset(self, request):
+        if user_is_team_scoped(request.user):
+            return scoped_queryset(self.model, self.group_filter_field, request.user)
+        return None
+
+    @cached_property
+    def permission_policy(self):
+        return self.permission_policy_class(
+            self.model, group_filter_field=self.group_filter_field
+        )
+
+
+class TeamScopedGetObjectMixin:
+    """For snippet object views that fetch straight from the model with no
+    instance permission check (Inspect/History/Usage/Copy): 404 when a
+    team-scoped member addresses an out-of-scope object by URL. Set
+    ``group_filter_field`` on the view subclass."""
+
+    group_filter_field: str
+
+    def get_object(self, queryset=None):
+        obj = super().get_object(queryset)
+        if not instance_in_scope(
+            self.request.user, self.model, self.group_filter_field, obj.pk
+        ):
+            raise Http404
+        return obj

cms/authapi/test_teams.py

@@ -45,8 +45,8 @@ def make_user(group_name, email):
     return user
 
 
-def make_team(name, slug, *, members=(), group_slugs=()):
-    team = Team.objects.create(name=name, slug=slug)
+def make_team(name, *, members=(), group_slugs=()):
+    team = Team.objects.create(name=name)
     for user in members:
         TeamMembership.objects.create(team=team, user=user)
     for group_slug in group_slugs:
@@ -104,27 +104,27 @@ def test_superuser_never_scoped(self):
         root = get_user_model().objects.create_superuser(
             username="root@d.org", email="root@d.org", password=PASSWORD
         )
-        make_team("Team", "team", members=[root], group_slugs=["ga"])
+        make_team("Team", members=[root], group_slugs=["ga"])
         self.assertFalse(user_is_team_scoped(root))
 
     def test_admin_group_never_scoped(self):
         admin = make_user("admin", "admin@d.org")
-        make_team("Team", "team", members=[admin], group_slugs=["ga"])
+        make_team("Team", members=[admin], group_slugs=["ga"])
         self.assertFalse(user_is_team_scoped(admin))
 
     def test_editor_without_team_not_scoped(self):
         self.assertFalse(user_is_team_scoped(make_user("editor", "e@d.org")))
 
     def test_editor_with_team_is_scoped(self):
         editor = make_user("editor", "e@d.org")
-        make_team("Team A", "team-a", members=[editor], group_slugs=["ga", "gb"])
+        make_team("Team A", members=[editor], group_slugs=["ga", "gb"])
         self.assertTrue(user_is_team_scoped(editor))
         self.assertEqual(map_group_slugs_for_user(editor), {"ga", "gb"})
 
     def test_slugs_union_across_teams(self):
         editor = make_user("editor", "e@d.org")
-        make_team("T1", "t1", members=[editor], group_slugs=["ga"])
-        make_team("T2", "t2", members=[editor], group_slugs=["gb", "gc"])
+        make_team("T1", members=[editor], group_slugs=["ga"])
+        make_team("T2", members=[editor], group_slugs=["gb", "gc"])
         self.assertEqual(map_group_slugs_for_user(editor), {"ga", "gb", "gc"})
 
 
@@ -136,7 +136,7 @@ def setUpTestData(cls):
             Gallery, group_filter_field="map_group_id"
         )
         cls.member = make_user("editor", "member@d.org")
-        make_team("Team A", "team-a", members=[cls.member], group_slugs=["ga"])
+        make_team("Team A", members=[cls.member], group_slugs=["ga"])
         cls.mine = make_gallery("mine", group_slug="ga")
         cls.theirs = make_gallery("theirs", group_slug="gb")
 
@@ -176,7 +176,7 @@ class GalleryAdminScopingViewTests(TestCase):
     def setUpTestData(cls):
         ensure_map_group_table()
         cls.member = make_user("editor", "member@d.org")
-        make_team("Team A", "team-a", members=[cls.member], group_slugs=["ga"])
+        make_team("Team A", members=[cls.member], group_slugs=["ga"])
         cls.mine = make_gallery("scoped-visible", group_slug="ga")
         cls.theirs = make_gallery("scoped-hidden", group_slug="gb")
 
@@ -208,6 +208,29 @@ def test_create_view_restricts_map_group_to_team(self):
         self.assertEqual(set(field.queryset.values_list("slug", flat=True)), {"ga"})
         self.assertTrue(field.required)
 
+    def test_unpublish_out_of_scope_denied(self):
+        # UnpublishView checks only the model-level publish permission; the
+        # generic before_unpublish hook is the instance-level gate.
+        url = reverse(
+            "wagtailsnippets_galleries_gallery:unpublish", args=[self.theirs.pk]
+        )
+        self.client.post(url)
+        self.theirs.refresh_from_db()
+        self.assertTrue(self.theirs.live)
+
+    def test_copy_out_of_scope_404(self):
+        # The stock CopyView prefills from a bare get_object_or_404 — the
+        # scoped copy view must 404 out-of-scope sources.
+        url = reverse("wagtailsnippets_galleries_gallery:copy", args=[self.theirs.pk])
+        self.assertEqual(self.client.get(url).status_code, 404)
+
+    def test_copy_in_scope_restricts_map_group(self):
+        url = reverse("wagtailsnippets_galleries_gallery:copy", args=[self.mine.pk])
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 200)
+        field = response.context["form"].fields["map_group"]
+        self.assertEqual(set(field.queryset.values_list("slug", flat=True)), {"ga"})
+
 
 class MapModuleScopingTests(TestCase):
     """DistrictrMap modules: members get scoped, view-only access (admins keep
@@ -233,7 +256,7 @@ def setUpTestData(cls):
         DistrictrMapsToGroups.objects.create(districtrmap=cls.map_a, group=group_a)
         DistrictrMapsToGroups.objects.create(districtrmap=cls.map_b, group=group_b)
         cls.member = make_user("editor", "mm-member@d.org")
-        make_team("Map Team A", "mm-team-a", members=[cls.member], group_slugs=["ga"])
+        make_team("Map Team A", members=[cls.member], group_slugs=["ga"])
 
     def test_member_view_instances_scoped(self):
         qs = self.policy.instances_user_has_permission_for(self.member, "view")
@@ -320,7 +343,7 @@ def setUpTestData(cls):
         cls.places_index.add_child(instance=cls.place_out)
 
         cls.member = make_user("editor", "tp-member@d.org")
-        make_team("Tag Team A", "tp-team-a", members=[cls.member], group_slugs=["ga"])
+        make_team("Tag Team A", members=[cls.member], group_slugs=["ga"])
         cls.admin = make_user("admin", "tp-admin@d.org")
 
     def _request(self, user):
@@ -382,6 +405,31 @@ def test_admin_never_blocked(self):
             _is_out_of_scope_page(self._request(self.admin), self.place_out)
         )
 
+    def test_all_page_mutation_hooks_registered(self):
+        # Wagtail's unpublish/copy/move/bulk paths never fire the edit/delete
+        # hooks — each needs its own registration or it defaults to open.
+        from wagtail import hooks as wagtail_hooks
+
+        for name in (
+            "before_edit_page",
+            "before_delete_page",
+            "before_unpublish_page",
+            "before_copy_page",
+            "before_move_page",
+            "before_bulk_action",
+        ):
+            modules = [fn.__module__ for fn in wagtail_hooks.get_hooks(name)]
+            self.assertIn("content.wagtail_hooks", modules, name)
+
+    def test_member_cannot_unpublish_out_of_scope_page_via_admin(self):
+        self.client.force_login(self.member)
+        response = self.client.post(
+            reverse("wagtailadmin_pages:unpublish", args=[self.tag_out.id])
+        )
+        self.assertNotEqual(response.status_code, 200)
+        self.tag_out.refresh_from_db()
+        self.assertTrue(self.tag_out.live)
+
 
 class ContentPageFormScopingTests(TestCase):
     """The team-aware page forms only offer a member their own teams' map slugs
@@ -402,7 +450,7 @@ def setUpTestData(cls):
             )
             DistrictrMapsToGroups.objects.create(districtrmap=dmap, group=group)
         cls.member = make_user("editor", "form-member@d.org")
-        make_team("Form Team", "form-team", members=[cls.member], group_slugs=["ga"])
+        make_team("Form Team", members=[cls.member], group_slugs=["ga"])
         cls.admin = make_user("admin", "form-admin@d.org")
 
     @staticmethod
@@ -451,3 +499,27 @@ def test_admin_form_unrestricted(self):
         # Admin keeps the plain free-text CharField (no scoped choices).
         form = self._bound(TagPage, user=self.admin)
         self.assertFalse(hasattr(form.fields["districtr_map_slug"], "choices"))
+
+    def test_placepage_form_preserves_other_teams_slugs_and_order(self):
+        # A shared PlacePage carries another team's map; saving must keep it,
+        # in its original position, even though the member can't select it.
+        page = PlacePage(
+            title="P", slug="p", districtr_map_slugs=["tx_other", "chi_wards"]
+        )
+        form = self._form_class(PlacePage)(
+            data={
+                "title": "P",
+                "slug": "p",
+                "districtr_map_slugs": ["chi_wards"],
+                "body-count": "0",
+            },
+            instance=page,
+            for_user=self.member,
+        )
+        # full_clean rather than is_valid: the bare instance lacks Wagtail's
+        # tree fields (path/depth/...), which aren't what's under test here.
+        form.full_clean()
+        self.assertNotIn("districtr_map_slugs", form.errors)
+        self.assertEqual(
+            form.cleaned_data["districtr_map_slugs"], ["tx_other", "chi_wards"]
+        )

cms/authapi/wagtail_hooks.py

@@ -113,13 +113,12 @@ class TeamViewSet(SnippetViewSet):
     menu_label = "Teams"
     menu_order = 260  # after "Review tag scopes" (250)
     add_to_admin_menu = True
-    list_display = ["name", "slug"]
-    search_fields = ["name", "slug"]
+    list_display = ["name"]
+    search_fields = ["name"]
     list_per_page = 50
 
     panels = [
         FieldPanel("name"),
-        FieldPanel("slug"),
         InlinePanel(
             "memberships",
             heading="Members",

cms/content/api.py

@@ -29,15 +29,14 @@
 from django.views.decorators.http import require_GET
 
 from content.models import PlacePage, TagPage
-from core.api import _json
+from core.api import MAX_PAGE_SIZE, _json, pagination
 
 CONTENT_TYPE_PAGES = {
     "tags": TagPage,
     "places": PlacePage,
 }
 
 DEFAULT_LANGUAGE = "en"
-MAX_PAGE_SIZE = 100
 
 # Stable ordering for available_languages / list endpoints.
 _LANGUAGE_ORDER = {
@@ -79,7 +78,7 @@ def content_detail(request, content_type, slug):
     # than loading every language's StreamField body just to pick one.
     live_pages = model.objects.live().filter(slug=slug)
     available_languages = sorted(
-        live_pages.values_list("locale__language_code", flat=True),
+        live_pages.values_list("locale__language_code", flat=True).distinct(),
         key=_language_sort_key,
     )
 
@@ -124,8 +123,7 @@ def content_list(request, content_type):
         return _json({"detail": f"Unknown content type '{content_type}'"}, status=404)
 
     try:
-        offset = max(int(request.GET.get("offset", 0)), 0)
-        limit = min(int(request.GET.get("limit", MAX_PAGE_SIZE)), MAX_PAGE_SIZE)
+        offset, limit = pagination(request)
     except ValueError:
         return _json({"detail": "offset and limit must be integers"}, status=400)