Problems limiting editors to their own content in Wagtail admin

Question

Users that have been assigned to a group with 'add' permissions are able to access, copy, move and add pages created by other users via the admin search or by directly entering the correct path in the browser.

The goal is to prevent users from seeing anything the other users are doing. I had thought it was pretty much implemented.

My page tree looks like this:

Home > Persons > Person Profile > Person Story

Users sign up for an account and are automatically assigned to a custom 'Authors' group. This group has 'add' and 'publish' permissions on the Persons page. The user is responsible for any number of people on their team. With this setup they are able to add a Profile page for each member of their team. Then multiple stories may be added for each person with a profile. Now each Person has subpages of Stories linked to their profile.

I have the page explorer set so users only see their pages:

@hooks.register('construct_explorer_page_queryset')
def show_authors_only_their_articles(parent_page, pages, request):
    user_group = request.user.groups.filter(name='Authors').exists()
    if user_group:
        pages = pages.filter(owner=request.user)

    return pages

The image chooser also only displays images uploaded by the user:

@hooks.register('construct_image_chooser_queryset')
def filter_images_by_user(images, request):
    images = images.filter(uploaded_by_user=request.user)

    return images

And page summary items show only what belongs to the user using similar code.

But during what I thought was going to be final testing, I discovered that a search done using the admin search leads to a list of all available Person Profile and Person Story pages with those search terms. For example if they search for 'John', all Profile and Story page are returned for John. Users may then click on John's Profile page. Once arriving on John's profile page in the explorer they are able to add Stories to John's profile, copy, move or unpublish it! They can do the same with John's stories, minus adding a subpage.

This is a game changer and won't work for us.

I've looked around and see what might be several solutions:

1) Create a similar setup using ModelAdmin but I think I'm going to have the same problem. When searching users will still be able to find and manipulate forbidden content.

2) Create a unique user group for each user as recommended in this post: Wagtail per page user permission

In the second method, after the user is created I would need to programmatically:

1) Create a new user group just for them, maybe using their username.

2) Assign them to the new user group

3) Create a new 'Person' page specific to them and grant them 'add' and 'publish' permissions to it.

The last step because it seems that if I assign them all to the same Person page, they will still be able to add pages to other users Profiles regardless of being in a different user group, since all those different user groups will still have add access to the same Person page.

Ultimately I need to block each user off from what the other users are doing. Your thoughts are much appreciated. It's been years since I've done any programming and I'm still catching up. In the meantime I'm going to start seeing I can come up with.

I think we are pretty close. The system works and flows so well!

Answer 1

I finally figure this one out by searching for instances of GroupPagePermission and GroupCollectionPermission in the Wagtail core package. Was able to piece it together looking at how they did it.

In the models.py of an app I have called 'users' I implemented the django-allauth user_sign_up @receiver. As soon as the user is successfully signed up it runs the below code:

from django.contrib.auth.models import Group, Permission
from django.dispatch import receiver
from allauth.account.signals import user_signed_up
from wagtail.core.models import Page, GroupPagePermission, GroupCollectionPermission, Collection
from article.models import PersonIndexPage

@receiver(user_signed_up)
def create_user_group_and_pages(sender, **kwargs):
    """
    When a new user signs up create a unique group and page for them.
    Assign it the appropriate permission for admin, page and collection access.
    """

    # Grab the new user
    user = kwargs['user']

    # Create a group object that matches their username
    new_group, created = Group.objects.get_or_create(name=user.username)

    # Add the new group to the database
    user.groups.add(new_group)

    # Create new permission to access the wagtail admin
    access_admin = Permission.objects.get(codename='access_admin')

    # Add the permission to the group
    new_group.permissions.add(access_admin)

    # Now start creating page access
    # First find the homepage
    home = Page.objects.get(slug='home').specific

    # Create unique PersonIndexPage for the user
    person_index_page = PersonIndexPage(title=user.username)

    # Add PersonIndexPage to homepage as a child
    home.add_child(instance=person_index_page)

    # Save new page as first revision
    person_index_page.save_revision()

    # Create new add GroupPagePermission
    GroupPagePermission.objects.create(
        group=new_group,
        page=person_index_page,
        permission_type='add'
    )

    # Create new GroupCollectionPermission for Profile Images collection
    GroupCollectionPermission.objects.create(
        group=new_group,
        collection=Collection.objects.get(name='Images'),
        permission=Permission.objects.get(codename='add_image')
    )

Now when a creates a new account a new Index page is created for them that has a unique group created that gives them access to only that Index page and it's child pages. Effectively blocking them from access to any other content on the site. They can still see results to other pages in the admin search but don't have permission to do anything with those results.

Users can log in, create profiles for each person and then as many stories as they want for each person.