Add guarded content draft and publication services

apps/content/migrations/0002_alter_siteidentity_options.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.5 on 2026-09-27 06:15
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('content', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='siteidentity',
+            options={'permissions': [('change_content_draft', 'Can change content drafts'), ('preview_content_draft', 'Can preview content drafts'), ('publish_content', 'Can publish content'), ('restore_content', 'Can restore published content')]},
+        ),
+    ]

apps/content/migrations/0003_content_groups.py

@@ -0,0 +1,34 @@
+from django.db import migrations
+
+
+def create_groups(apps, schema_editor):
+    ContentType = apps.get_model("contenttypes", "ContentType")
+    Permission = apps.get_model("auth", "Permission")
+    Group = apps.get_model("auth", "Group")
+    content_type, _ = ContentType.objects.using(schema_editor.connection.alias).get_or_create(app_label="content", model="siteidentity")
+    labels = {
+        "change_content_draft": "Can change content drafts",
+        "preview_content_draft": "Can preview content drafts",
+        "publish_content": "Can publish content",
+        "restore_content": "Can restore published content",
+    }
+    permissions = {}
+    for codename, name in labels.items():
+        permission, _ = Permission.objects.using(schema_editor.connection.alias).get_or_create(content_type=content_type, codename=codename, defaults={"name": name})
+        permissions[codename] = permission
+    for group_name, codenames in {
+        "content_editor": ("change_content_draft", "preview_content_draft"),
+        "content_publisher": tuple(labels),
+    }.items():
+        group, _ = Group.objects.using(schema_editor.connection.alias).get_or_create(name=group_name)
+        group.permissions.add(*(permissions[code] for code in codenames))
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("content", "0002_alter_siteidentity_options"),
+        ("auth", "0012_alter_user_first_name_max_length"),
+        ("contenttypes", "0002_remove_content_type_name"),
+    ]
+
+    operations = [migrations.RunPython(create_groups, migrations.RunPython.noop)]