Align CMS with use case: own-content editors, team-enforced galleries, StaticPage

Product decisions (Dylan, 2026-08-04):

- Editors edit only their own content: content/0004 revokes the editor
  group's tree-wide change_page; add_page + Wagtail's owner model grant edit
  on owned pages, publish_page applies only to those. migrate_tiptap gains
  --owners "auth0|sub=email,..." to set Page.owner from the legacy author
  column (Auth0 subjects) so pre-cutover content stays editable.
- group_only galleries enforced via Teams: JWT gains a map_groups claim
  (user's teams' MapGroup slugs); the gallery API requires the gallery's
  map_group in that claim or the admin role — any-valid-login no longer opens
  restricted galleries.
- StaticPage type (+ StaticIndexPage) with /api/content/static/... served by
  a Next.js /[slug] catch-all; hardcoded routes take precedence, so static
  pages migrate into the CMS one at a time.
- District-comments 403 for tag-scoped reviewers: decided to keep as-is.

FOLLOWUPS doc updated; cms 220 tests, backend suite, typecheck + build green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: nofurtherinformation

.agents/WAGTAIL-CUTOVER-FOLLOWUPS.md

@@ -20,34 +20,24 @@ replaced with real `Model(**row._asdict())` instances.
 
 ---
 
-## 1. Product decisions needed (blockers for *deciding*, not for shipping)
-
-### 1.1 Editor scope: all pages vs. own-content-only
-The legacy FastAPI CMS let editors modify only content they authored
-(`update:content` vs `update:update-all` scope split). The Wagtail replacement
-grants editor/admin **full-tree** add/change/publish on the page root
-([cms/content/migrations/0002_grant_page_permissions.py](../cms/content/migrations/0002_grant_page_permissions.py)
-— docstring records this decision as deferred).
-
-- Wagtail-native way to restore own-content-only: grant `add_page` **without**
-  `change_page` — owners get implicit edit rights on pages they created.
-- If chosen, `migrate_tiptap` should also set `Page.owner` from the legacy
-  `author` column during import (currently dropped).
-
-### 1.2 group_only galleries: who actually gets access?
-Today any **valid Districtr token** opens a `group_only` gallery — the
-`Gallery.map_group` FK is an unenforced placeholder
-([cms/galleries/api.py](../cms/galleries/api.py), documented simplification).
-Real enforcement needs:
-- a user→MapGroup assignment model in `authapi` (mirror `ReviewTagAssignment`),
-- a claim in the JWT (e.g. `map_groups`) minted in
-  [cms/authapi/serializers.py](../cms/authapi/serializers.py),
-- the gallery API checking claim ∩ `gallery.map_group`.
-Also decide whether the unit of scoping is `MapGroup` at all, or the Django
-auth group (the `roles` claim already exists) — if the latter, repoint the FK
-before anyone stores data against it.
-
-### 1.3 Refresh-token security posture
+## 1. Product decisions — RESOLVED 2026-08-04 (session with Dylan)
+
+### 1.1 ✅ Editor scope: **own-content-only** (+ teams for manual control)
+Shipped: `content/0004_editor_own_content_only` revokes the editor group's
+tree-wide `change_page`; editors keep `add_page` (Wagtail's owner model grants
+edit on owned pages) + `publish_page` (applies only to editable, i.e. own,
+pages). `migrate_tiptap --owners "auth0|xx=email,..."` sets `Page.owner` from
+the legacy `author` column (Auth0 subjects — the sub→email mapping must be
+supplied at cutover; there are two distinct authors in the data).
+
+### 1.2 ✅ group_only galleries: **enforced via Teams**
+Shipped: the JWT carries a `map_groups` claim (slugs across the user's teams,
+minted in [cms/authapi/serializers.py](../cms/authapi/serializers.py));
+[cms/galleries/api.py](../cms/galleries/api.py) requires the gallery's
+`map_group` slug in that claim, or the `admin` role. A merely-valid login no
+longer opens group_only galleries. Scoping unit confirmed as `MapGroup`.
+
+### 1.3 Refresh-token security posture (still open, low priority)
 `BLACKLIST_AFTER_ROTATION` was turned **off**
 ([cms/config/settings/base.py](../cms/config/settings/base.py)) because Next.js
 RSCs cannot persist rotated cookies — single-use tokens deterministically
@@ -62,7 +52,7 @@ or make middleware the *only* refresher and re-enable blacklisting.
 
 | Item | Where | Notes |
 |---|---|---|
-| ⏳ **NEEDS DECISION** — District comments for tag-scoped reviewers | [backend/app/comments/main.py](../backend/app/comments/main.py) | Blanket 403 today (district comments are tag-less). Either tag district comments at sync time or add per-document scoping. Menu link already hidden for scoped reviewers. |
+| ✅ **DECIDED 2026-08-04: leave as-is** — District comments for tag-scoped reviewers | [backend/app/comments/main.py](../backend/app/comments/main.py) | Blanket 403 stays: scoped reviewers moderate community comments only; full reviewers/admins handle district comments. Menu link already hidden for scoped reviewers. |
 | ✅ **DONE** — `/places` "N map modules" count | [app/src/app/(static)/places/page.tsx](../app/src/app/(static)/places/page.tsx) | Restored: card shows `N map module(s)` from the `districtr_map_slugs` the list endpoint returns. |
 | ✅ **DONE** — GET `/auth/logout` CSRF | [app/src/app/auth/logout/route.ts](../app/src/app/auth/logout/route.ts) | Guarded with the Fetch-Metadata `Sec-Fetch-Site` header — an explicit `cross-site` GET bounces home WITHOUT signing out; same-origin/same-site/direct nav still log out. Chose this over the auto-submit-form approach: lower risk, no coupling to NextAuth CSRF internals, no redirect flash. |
 | ⏳ **DEFERRED** (long-term) — PermissionGuard reads raw JWT client-side | [app/src/app/admin/components/PermissionGuard.tsx](../app/src/app/admin/components/PermissionGuard.tsx) | Now base64url-safe via shared `decodeJwtPayload`, but long-term the access token shouldn't need to reach the client at all — pass roles/scopes as typed session fields and keep the token server-side. Larger auth-session refactor; left as-is. |
@@ -137,7 +127,13 @@ or make middleware the *only* refresher and re-enable blacklisting.
 3. Staging rehearsal on the `-dev` Fly apps first (full sequence below, plus a
    backend `alembic revision --autogenerate` afterward proving an empty diff).
 4. Merge → CI deploys api/app/cms (release commands run both migration systems).
-5. `manage.py migrate_tiptap --dry-run` → review report → real run.
+5. `manage.py migrate_tiptap --dry-run` → review report → real run **with
+   `--owners "auth0|<sub>=<email>,..."`** (map the two legacy author subjects
+   to provisioned users so their pages stay editable under own-content-only).
+5b. In the Wagtail admin, add a "Static pages" index page under Home
+   (StaticPage type, new 2026-08-04): static site pages migrate into the CMS
+   one at a time — delete the hardcoded Next.js route, publish a StaticPage
+   with the same slug (the `/[slug]` catch-all serves it).
 6. `manage.py provision_users users.csv` (CSV: email,name,group) — sends
    password-setup emails.
 7. Smoke: Wagtail login, edit+publish a page, comment moderation at

app/src/app/(static)/[slug]/page.tsx

@@ -0,0 +1,43 @@
+import {LanguagePicker} from '@/app/components/LanguagePicker/LanguagePicker';
+import StreamRenderer from '@/app/components/RichTextRenderer/StreamRenderer';
+import {getCMSContent} from '@/app/utils/api/cmsContent';
+import {Flex, Heading} from '@radix-ui/themes';
+import {cookies} from 'next/headers';
+import {notFound} from 'next/navigation';
+
+// Catch-all for CMS-authored static pages. Hardcoded routes (about/, rules/,
+// ...) take precedence in Next.js routing, so pages migrate into the CMS one
+// at a time: delete the hardcoded route and publish a StaticPage of the same
+// slug.
+export const revalidate = 3600;
+
+export async function generateMetadata({params}: {params: Promise<{slug: string}>}) {
+  const [{slug}, userCookies] = await Promise.all([params, cookies()]);
+  const language = userCookies.get('language')?.value ?? 'en';
+  const cmsData = await getCMSContent('static', slug, language).catch(() => null);
+  const title = cmsData?.content?.title;
+  return title ? {title} : {};
+}
+
+export default async function Page({params}: {params: Promise<{slug: string}>}) {
+  const [{slug}, userCookies] = await Promise.all([params, cookies()]);
+  const language = userCookies.get('language')?.value ?? 'en';
+  const cmsData = await getCMSContent('static', slug, language).catch(() => null);
+
+  if (!cmsData?.content) {
+    notFound();
+  }
+
+  return (
+    <Flex direction="column" width="100%">
+      <Heading as="h1" size="6" mb="4">
+        {cmsData.content.title}
+      </Heading>
+      <LanguagePicker
+        preferredLanguage={language}
+        availableLanguages={cmsData.available_languages}
+      />
+      <StreamRenderer body={cmsData.content.body} className="my-4" />
+    </Flex>
+  );
+}

app/src/app/utils/api/cmsContent.ts

@@ -15,7 +15,7 @@ export const CMS_API_URL =
     ? (process.env.CMS_URL ?? process.env.NEXT_PUBLIC_CMS_URL)
     : process.env.NEXT_PUBLIC_CMS_URL;
 
-export type CmsContentTypes = 'tags' | 'places';
+export type CmsContentTypes = 'tags' | 'places' | 'static';
 
 /** StreamField blocks returned in `content.body` */
 export interface RichTextBlock {
@@ -87,10 +87,13 @@ export interface TagsCMSContent extends CMSContent {
 export interface PlacesCMSContent extends CMSContent {
   districtr_map_slugs: string[] | null;
 }
+/** Static site pages (about, rules, ...) carry no map association. */
+export type StaticCMSContent = CMSContent;
 
 interface CmsContentTypesEnum {
   tags: TagsCMSContent;
   places: PlacesCMSContent;
+  static: StaticCMSContent;
 }
 
 export interface CMSContentResponseWithLanguages<

cms/authapi/serializers.py

@@ -4,6 +4,7 @@
 )
 
 from authapi.scopes import scopes_for_user
+from authapi.teams import map_group_slugs_for_user
 from authapi.tokens import KidRefreshToken
 
 
@@ -42,6 +43,12 @@ def get_token(cls, user):
         token["roles"] = group_names
         if review_tags:
             token["review_tags"] = review_tags
+        # MapGroup slugs across the user's teams: the galleries API matches
+        # this claim against Gallery.map_group for group_only galleries
+        # (admins bypass via the roles claim). Absent when team-less.
+        map_groups = sorted(map_group_slugs_for_user(user))
+        if map_groups:
+            token["map_groups"] = map_groups
         return token
 
 

cms/content/api.py

@@ -28,12 +28,13 @@
 from django.conf import settings
 from django.views.decorators.http import require_GET
 
-from content.models import PlacePage, TagPage
+from content.models import PlacePage, StaticPage, TagPage
 from core.api import MAX_PAGE_SIZE, _json, pagination
 
 CONTENT_TYPE_PAGES = {
     "tags": TagPage,
     "places": PlacePage,
+    "static": StaticPage,
 }
 
 DEFAULT_LANGUAGE = "en"
@@ -60,7 +61,7 @@ def _serialize_page(page, content_type):
     }
     if content_type == "tags":
         content["districtr_map_slug"] = page.districtr_map_slug or None
-    else:
+    elif content_type == "places":
         content["districtr_map_slugs"] = page.districtr_map_slugs or None
     return content
 
@@ -146,7 +147,7 @@ def content_list(request, content_type):
         # modules per place without fetching each page.
         if content_type == "tags":
             item["districtr_map_slug"] = page.districtr_map_slug or None
-        else:
+        elif content_type == "places":
             item["districtr_map_slugs"] = page.districtr_map_slugs or None
         results.append(item)
     return _json(results)

cms/content/management/commands/migrate_tiptap.py

@@ -16,9 +16,11 @@
 - Re-running upserts by (type, slug, locale): existing pages are updated in
   place (and skipped entirely when already identical), never duplicated.
 
-Not carried over: legacy `author` (an Auth0 subject string with no Django
-user to map to) and created_at/updated_at (Wagtail manages its own
-first/last_published_at via publish()).
+Legacy `author` is an Auth0 subject string with no automatic Django user
+mapping; pass --owners "auth0|xx=email@x.org,..." to set Page.owner (which
+is what keeps pre-cutover content editable by its authors under the
+editors-own-content-only permission model). created_at/updated_at are not
+carried (Wagtail manages its own first/last_published_at via publish()).
 
 --dry-run converts everything without writing and emits a per-row report:
 input node-type counts, output block-type counts, and a
@@ -29,6 +31,7 @@
 import json
 from collections import Counter, defaultdict
 
+from django.contrib.auth import get_user_model
 from django.core.management.base import BaseCommand, CommandError
 from django.db import connection, transaction
 from wagtail.models import Locale, Page, Site
@@ -103,9 +106,38 @@ def add_arguments(self, parser):
             metavar="PATH",
             help="Write the full per-row report to PATH as JSON.",
         )
+        parser.add_argument(
+            "--owners",
+            metavar="SUB=EMAIL[,SUB=EMAIL...]",
+            help=(
+                "Map legacy author Auth0 subjects to provisioned users by "
+                "email; matched pages get that user as Page.owner (editors "
+                "hold add-only page permission, so ownership is what keeps "
+                "pre-cutover content editable by its authors). Unmapped or "
+                "unknown authors are warned and left ownerless."
+            ),
+        )
+
+    def _parse_owners(self, spec):
+        """``sub=email,...`` -> {sub: User}; warns on unknown emails."""
+        owners = {}
+        if not spec:
+            return owners
+        User = get_user_model()
+        for pair in spec.split(","):
+            sub, _, email = pair.partition("=")
+            user = User.objects.filter(email=email.strip()).first()
+            if user is None:
+                self.stderr.write(
+                    self.style.WARNING(f"--owners: no user with email '{email}'")
+                )
+            else:
+                owners[sub.strip()] = user
+        return owners
 
     def handle(self, *args, **options):
         dry_run = options["dry_run"]
+        self.owners = self._parse_owners(options.get("owners"))
         report = []
         failed_rows = 0
         pages_created = 0
@@ -308,6 +340,12 @@ def _upsert_page(self, config, row, entry, canonical_page, is_canonical):
             created = True
 
         changed = self._apply_row(config, page, row, entry)
+        owner = self.owners.get(row.get("author") or "")
+        if owner is not None and page.owner_id != owner.pk:
+            page.owner = owner
+            page.save(update_fields=["owner"])
+            changed = True
+
         if created:
             return page, "created"
         return page, ("updated" if changed else "unchanged")

cms/content/migrations/0004_editor_own_content_only.py

@@ -0,0 +1,55 @@
+"""
+Editors edit only their own content (product decision 2026-08-04, resolving
+the deferral documented in 0002): revoke the editor group's tree-wide
+`change_page`. Wagtail's owner model does the rest — a group holding only
+`add_page` on a tree may still edit pages it owns — and the retained
+`publish_page` applies only to pages the user can edit, i.e. their own.
+Admins keep full-tree permissions. migrate_tiptap sets Page.owner from the
+legacy author column so pre-cutover content stays editable by its authors.
+
+Team scoping (authapi/teams.py) composes with this: it further narrows which
+pages are *visible/actionable*; ownership now governs which are *editable*.
+"""
+
+from django.db import migrations
+
+
+def _editor_change_page(apps):
+    Group = apps.get_model("auth", "Group")
+    GroupPagePermission = apps.get_model("wagtailcore", "GroupPagePermission")
+    return GroupPagePermission.objects.filter(
+        group=Group.objects.get(name="editor"),
+        permission__content_type__app_label="wagtailcore",
+        permission__content_type__model="page",
+        permission__codename="change_page",
+    )
+
+
+def revoke_editor_change_page(apps, schema_editor):
+    _editor_change_page(apps).delete()
+
+
+def restore_editor_change_page(apps, schema_editor):
+    Group = apps.get_model("auth", "Group")
+    Page = apps.get_model("wagtailcore", "Page")
+    Permission = apps.get_model("auth", "Permission")
+    GroupPagePermission = apps.get_model("wagtailcore", "GroupPagePermission")
+    GroupPagePermission.objects.get_or_create(
+        group=Group.objects.get(name="editor"),
+        page=Page.objects.get(pk=1),
+        permission=Permission.objects.get(
+            content_type__app_label="wagtailcore",
+            content_type__model="page",
+            codename="change_page",
+        ),
+    )
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("content", "0003_alter_placepage_body_alter_tagpage_body"),
+    ]
+
+    operations = [
+        migrations.RunPython(revoke_editor_change_page, restore_editor_change_page),
+    ]