CMS review fixes: team-scope the data tools, safer commands, pinned deps

Review feedback on #714:
- Overlay uploads: a team-scoped super partner's map choices (and the
  POST validation queryset) narrow to their teams' maps; previously any
  map in the database could be targeted.
- Thumbnail regeneration 404s for out-of-scope maps instead of
  scheduling backend work with the service token.
- custom_style must be a JSON object: valid-but-non-object JSON would
  fail OverlayPublic response validation and 500 affected maps.
- migrate_tiptap wraps the standalone write pass in one transaction so
  the fidelity-check failure rolls back every page written this run
  (matching the atomic-migration behaviour); the JSON report still
  writes on failure.
- provision_users resends the setup email for existing accounts that
  still have unusable passwords, so a failed send is recoverable by
  re-running the command.
- requirements.lock (pip freeze of the built image) used as a pip
  constraints file: this service signs every auth token post-cutover,
  so transitive crypto/JWT versions must not drift between builds.
- HSTS in production settings (the ALB already redirects HTTP→HTTPS).
- review:review-all minted CMS-side: admins get the new explicit
  tag-scoping bypass; partners still never do (see #712).
- Compose no longer sends the removed 'visible' flag (see #713).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: nofurtherinformation

cms/.env.docker

@@ -0,0 +1,32 @@
+# Districtr CMS (Wagtail) — local dev via docker-compose
+DJANGO_SETTINGS_MODULE=config.settings.dev
+DJANGO_SECRET_KEY=django-insecure-dev-only-key
+
+# Postgres (same database as the FastAPI backend; Django tables live in the
+# `admin` schema via search_path)
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=postgres
+POSTGRES_DB=districtr
+POSTGRES_SERVER=db
+POSTGRES_PORT=5432
+
+WAGTAILADMIN_BASE_URL=http://localhost:8001
+DEFAULT_FROM_EMAIL=noreply@districtr.org
+
+# FastAPI backend (GeoPackage import + thumbnail triggers; compose-internal)
+BACKEND_API_URL=http://backend:8000
+
+# Object storage for GeoPackage and overlay uploads — mirrors the backend's
+# env contract (backend/app/core/config.py). Set ACCOUNT_ID for Cloudflare
+# R2, or AWS_S3_ENDPOINT for a custom S3 endpoint; leave both unset for
+# plain AWS S3.
+#AWS_ACCESS_KEY_ID=
+#AWS_SECRET_ACCESS_KEY=
+#R2_BUCKET_NAME=
+#ACCOUNT_ID=
+#AWS_S3_ENDPOINT=
+
+# Public base URL stored as Overlay.source for uploaded overlays — the CDN
+# fronting the bucket (https://tilesets1.cdn.districtr.org in prod). When
+# unset, the raw s3://bucket/key path is stored instead.
+#OVERLAY_PUBLIC_URL_BASE=

cms/Dockerfile

@@ -7,8 +7,8 @@ ENV PYTHONUNBUFFERED=1 \
 
 WORKDIR /districtr-cms
 
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+COPY requirements.txt requirements.lock ./
+RUN pip install --no-cache-dir -r requirements.txt -c requirements.lock
 
 COPY . .
 

cms/Dockerfile.dev

@@ -6,8 +6,8 @@ ENV PYTHONUNBUFFERED=1 \
 
 WORKDIR /districtr-cms
 
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
+COPY requirements.txt requirements.lock ./
+RUN pip install --no-cache-dir -r requirements.txt -c requirements.lock
 
 COPY . .
 

cms/authapi/management/commands/provision_users.py

@@ -40,6 +40,19 @@ def add_arguments(self, parser):
             help="Report what would happen without writing or emailing",
         )
 
+    def _send_setup_email(self, email):
+        # No request here, so derive the email's domain/protocol from
+        # WAGTAILADMIN_BASE_URL (django.contrib.sites isn't installed,
+        # making domain_override mandatory).
+        base_url = urlparse(settings.WAGTAILADMIN_BASE_URL)
+        form = AccountSetupForm(data={"email": email})
+        if form.is_valid():
+            form.save(
+                domain_override=base_url.netloc,
+                use_https=base_url.scheme == "https",
+                email_template_name="registration/password_reset_email.html",
+            )
+
     def handle(self, *args, **options):
         User = get_user_model()
         created, skipped = 0, 0
@@ -58,8 +71,21 @@ def handle(self, *args, **options):
                         "one of admin/partner/super_partner"
                     )
 
-                if User.objects.filter(username=email).exists():
-                    self.stdout.write(f"skip (exists): {email}")
+                existing = User.objects.filter(username=email).first()
+                if existing is not None:
+                    if existing.has_usable_password():
+                        self.stdout.write(f"skip (exists): {email}")
+                        skipped += 1
+                        continue
+                    # Account created by a prior run whose setup email failed
+                    # to send (the user was already committed): resend so the
+                    # command is safely re-runnable instead of stranding the
+                    # account with an unusable password and no link.
+                    if options["dry_run"]:
+                        self.stdout.write(f"would resend setup email: {email}")
+                    else:
+                        self._send_setup_email(email)
+                        self.stdout.write(f"resent setup email: {email}")
                     skipped += 1
                     continue
 
@@ -82,17 +108,7 @@ def handle(self, *args, **options):
                 user.save()
                 user.groups.add(group)
 
-                # No request here, so derive the email's domain/protocol from
-                # WAGTAILADMIN_BASE_URL (django.contrib.sites isn't installed,
-                # making domain_override mandatory).
-                base_url = urlparse(settings.WAGTAILADMIN_BASE_URL)
-                form = AccountSetupForm(data={"email": email})
-                if form.is_valid():
-                    form.save(
-                        domain_override=base_url.netloc,
-                        use_https=base_url.scheme == "https",
-                        email_template_name="registration/password_reset_email.html",
-                    )
+                self._send_setup_email(email)
                 self.stdout.write(f"created: {email} ({group_name})")
                 created += 1
 

cms/authapi/scopes.py

@@ -22,6 +22,9 @@
 DELETE_ALL_CONTENT = "delete:delete-all"
 
 REVIEW_CONTENT = "create:content_review"
+# Explicit bypass of per-reviewer tag scoping. Only admins/superusers get it;
+# see the PARTNER_SCOPES note below.
+REVIEW_ALL_CONTENT = "review:review-all"
 
 ALL_SCOPES = [
     CREATE_DISTRICTR_MAPS,
@@ -37,11 +40,12 @@
     DELETE_CONTENT,
     DELETE_ALL_CONTENT,
     REVIEW_CONTENT,
+    REVIEW_ALL_CONTENT,
 ]
 
 # Page editing, galleries, and the datastore tools are all Wagtail-side
 # permissions (or service-token calls); the only FastAPI scope a user token
-# needs is comment moderation. No read:read-all: the backend treats that
+# needs is comment moderation. No review:review-all: the backend treats that
 # scope as "unrestricted, ignore review_tags", and partner moderation is
 # always scoped by the portal-derived review_tags claim (serializers.py).
 # super_partner's extra powers are Django model permissions, not scopes.

cms/authapi/tests.py

@@ -46,8 +46,9 @@ def fastapi_style_verify(token: str) -> dict:
 
 class ScopeMappingTests(TestCase):
     def test_partner_scopes(self):
-        # Comment moderation only — and no read:read-all, which would make
-        # the backend treat the token as unrestricted and ignore review_tags.
+        # Comment moderation only — and no review:review-all, which would
+        # make the backend treat the token as unrestricted and ignore
+        # review_tags.
         user = make_user("partner")
         self.assertEqual(scopes_for_user(user), "create:content_review")
 
@@ -105,7 +106,7 @@ class ReviewScopingClaimTests(TestCase):
     the user's teams' portals (a portal's page slug is its comment tag slug).
 
     The FastAPI backend (backend/app/comments/main.py::allowed_review_tags)
-    treats an ABSENT claim — or a token carrying `read:read-all` — as
+    treats an ABSENT claim — or a token carrying `review:review-all` — as
     unrestricted, and an EMPTY list as "allows nothing", so these tests pin:
     admins get no claim; team-scoped users get their portal slugs; team-less
     non-admins get [] (fail closed until they join a team).
@@ -147,7 +148,7 @@ def test_team_scoped_user_gets_portal_slugs(self):
 
         payload = self._claim_for(user)
         self.assertEqual(payload["review_tags"], ["environment", "schools"])
-        self.assertNotIn("read:read-all", payload["scope"].split())
+        self.assertNotIn("review:review-all", payload["scope"].split())
 
     def test_non_default_locale_portal_cannot_mint_scope(self):
         # Page slugs are unique only per parent and each locale has its own
@@ -192,7 +193,7 @@ def test_team_less_partner_fails_closed(self):
     def test_admin_gets_no_claim(self):
         payload = self._claim_for(make_user("admin"))
         self.assertNotIn("review_tags", payload)
-        self.assertIn("read:read-all", payload["scope"].split())
+        self.assertIn("review:review-all", payload["scope"].split())
 
     def test_superuser_gets_no_claim(self):
         user = make_user(None)
@@ -201,9 +202,10 @@ def test_superuser_gets_no_claim(self):
         payload = self._claim_for(user)
         self.assertNotIn("review_tags", payload)
 
-    def test_partner_scope_has_no_read_all(self):
-        # read:read-all would make the backend ignore review_tags entirely.
-        self.assertNotIn("read:read-all", scopes_for_user(make_user("partner")))
+    def test_partner_scope_has_no_review_all(self):
+        # review:review-all would make the backend ignore review_tags
+        # entirely.
+        self.assertNotIn("review:review-all", scopes_for_user(make_user("partner")))
 
 
 class TokenEndpointTests(TestCase):

cms/config/settings/production.py

@@ -8,6 +8,11 @@
 SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
 SESSION_COOKIE_SECURE = True
 CSRF_COOKIE_SECURE = True
+# HSTS: the ALB already redirects HTTP→HTTPS (infra/alb.ts); this makes
+# browsers skip the insecure hop entirely. The CMS lives on its own
+# subdomain, so include-subdomains is safe for this host.
+SECURE_HSTS_SECONDS = 31536000
+SECURE_HSTS_INCLUDE_SUBDOMAINS = True
 
 CSRF_TRUSTED_ORIGINS = [
     o for o in os.environ.get("DJANGO_CSRF_TRUSTED_ORIGINS", "").split(",") if o

cms/content/management/commands/migrate_tiptap.py

@@ -149,66 +149,81 @@ def handle(self, *args, **options):
         pages_updated = 0
         pages_skipped = 0
 
-        for content_type, config in CONTENT_TYPES.items():
-            rows = self._fetch_rows(config)
-            by_slug = defaultdict(dict)
-            for row in rows:
-                by_slug[row["slug"]][row["language"]] = row
-
-            for slug in sorted(by_slug):
-                lang_rows = by_slug[slug]
-                canonical_language = (
-                    DEFAULT_LANGUAGE
-                    if DEFAULT_LANGUAGE in lang_rows
-                    else sorted(lang_rows)[0]
-                )
-                if canonical_language != DEFAULT_LANGUAGE:
-                    self.stderr.write(
-                        self.style.WARNING(
-                            f"{content_type}/{slug}: no English row; using "
-                            f"'{canonical_language}' as canonical"
+        # One transaction around the whole pass: the fidelity-check
+        # CommandError below must roll back every page written this run,
+        # matching the all-or-nothing behaviour this command has when
+        # executed inside the atomic Django migration. (In dry-run no
+        # writes happen, so the wrapper is a no-op savepoint.)
+        try:
+            with transaction.atomic():
+                for content_type, config in CONTENT_TYPES.items():
+                    rows = self._fetch_rows(config)
+                    by_slug = defaultdict(dict)
+                    for row in rows:
+                        by_slug[row["slug"]][row["language"]] = row
+
+                    for slug in sorted(by_slug):
+                        lang_rows = by_slug[slug]
+                        canonical_language = (
+                            DEFAULT_LANGUAGE
+                            if DEFAULT_LANGUAGE in lang_rows
+                            else sorted(lang_rows)[0]
                         )
+                        if canonical_language != DEFAULT_LANGUAGE:
+                            self.stderr.write(
+                                self.style.WARNING(
+                                    f"{content_type}/{slug}: no English row; using "
+                                    f"'{canonical_language}' as canonical"
+                                )
+                            )
+
+                        canonical_page = None
+                        # Canonical language first; translations need it to exist.
+                        ordered = [canonical_language] + [
+                            language
+                            for language in sorted(lang_rows)
+                            if language != canonical_language
+                        ]
+                        for language in ordered:
+                            row = lang_rows[language]
+                            entry = self._convert_row(content_type, row)
+                            report.append(entry)
+                            if not entry["text_ok"]:
+                                failed_rows += 1
+                            self._print_entry(entry)
+
+                            if dry_run:
+                                continue
+
+                            with transaction.atomic():
+                                page, action = self._upsert_page(
+                                    config,
+                                    row,
+                                    entry,
+                                    canonical_page=canonical_page,
+                                    is_canonical=(language == canonical_language),
+                                )
+                            if language == canonical_language:
+                                canonical_page = page
+                            if action == "created":
+                                pages_created += 1
+                            elif action == "updated":
+                                pages_updated += 1
+                            else:
+                                pages_skipped += 1
+
+                if failed_rows:
+                    raise CommandError(
+                        f"{failed_rows} row(s) failed the plain-text fidelity check "
+                        "(see report lines marked TEXT-LOSS)."
                     )
-
-                canonical_page = None
-                # Canonical language first; translations need it to exist.
-                ordered = [canonical_language] + [
-                    language
-                    for language in sorted(lang_rows)
-                    if language != canonical_language
-                ]
-                for language in ordered:
-                    row = lang_rows[language]
-                    entry = self._convert_row(content_type, row)
-                    report.append(entry)
-                    if not entry["text_ok"]:
-                        failed_rows += 1
-                    self._print_entry(entry)
-
-                    if dry_run:
-                        continue
-
-                    with transaction.atomic():
-                        page, action = self._upsert_page(
-                            config,
-                            row,
-                            entry,
-                            canonical_page=canonical_page,
-                            is_canonical=(language == canonical_language),
-                        )
-                    if language == canonical_language:
-                        canonical_page = page
-                    if action == "created":
-                        pages_created += 1
-                    elif action == "updated":
-                        pages_updated += 1
-                    else:
-                        pages_skipped += 1
-
-        if options["json_report"]:
-            with open(options["json_report"], "w") as f:
-                json.dump(report, f, indent=2)
-            self.stdout.write(f"Report written to {options['json_report']}")
+        finally:
+            # The JSON report is the diagnostic naming the failed rows —
+            # write it even when the fidelity check rolls the pass back.
+            if options["json_report"]:
+                with open(options["json_report"], "w") as f:
+                    json.dump(report, f, indent=2)
+                self.stdout.write(f"Report written to {options['json_report']}")
 
         if not dry_run:
             self.stdout.write(
@@ -218,11 +233,6 @@ def handle(self, *args, **options):
                 )
             )
 
-        if failed_rows:
-            raise CommandError(
-                f"{failed_rows} row(s) failed the plain-text fidelity check "
-                "(see report lines marked TEXT-LOSS)."
-            )
         if dry_run:
             self.stdout.write(
                 self.style.SUCCESS(f"Dry run OK: {len(report)} row(s) converted.")