feat(ProjectHistoryLogs): create ph logs for permissions changes TASK-944

[rgraber]

🗒️ Checklist

1. run linter locally
2. update all related docs (API, README, inline, etc.), if any
3. draft PR with a title <type>(<scope>)<!>: <title> TASK-1234
4. tag PR: at least frontend or backend unless it's global
5. fill in the template below and delete template comments
6. review thyself: read the diff and repro the preview as written
7. open PR & confirm that CI passes
8. request reviewers, if needed
9. delete this section before merging

📣 Summary

Create project history logs when users are assigned permissions or have permissions revoked for a project.

👀 Preview steps

Note: for this test, all PH logs should have metadata['log_subtype']='permission' and metadata['asset_uid']=<the uid of the project you're updating>

1. ℹ️ have 3 accounts (at least 2 non-superuser). For this test we'll call them user1, user2, and user3 (user2 and user3 are not super)
2. ℹ️ have a project owned by user1 with at least 1 submission
3. Log in as user1
4. Go to Project > Settings > Sharing
5. Toggle 'Allow submissions to this form without a username and password'
6. Go to /api/v2/audit-logs/?q=log_type:project-history AND metadata__asset_uid:<Project1.uid>
7. 🟢 There should be a new PH log with action='allow-anonymous-submissions' (usual metadata)
8. Toggle 'Allow submissions...' off again
9. 🟢 Reload the endpoint. There should be a new PH log with action='disallow-anonymous-submissions'
10. Check "Anyone can view this form"
11. 🟢 Reload the endpoint. There should be a new PH log with action='share-form-publicly'
12. Check "Anyone can view submissions made to this form"
13. 🟢 Reload the endpoint. There should be a new PH log with action='share-data-publicly'
14. Uncheck "Anyone can view submissions made to this form"
15. 🟢 Reload the endpoint. There should be a new PH log with action='unshare-data-publicly'
16. Uncheck "Anyone can view this form"
17. 🟢 Reload the endpoint. There should be a new PH log with action='unshare-form-publicly'
18. Click 'Add User'. Grant user2 permission to Edit Form
19. 🟢 Reload the endpoint. There should be a new PH log with action='modify-user-permissions' and

metadata['permissions'] =
{
"username": "user2",
"added": ["change_asset", "view_asset"],  # order doesn't matter
"removed":[]
}

20. Uncheck "Edit form" and check "Edit submissions only from specific users" -> "user2"
21. Click "Update permissions"
22. 🟢 Reload the endpoint. There should be a new PH log with action='modify-user-permissions' and

metadata['permissions'] =
{
"username": "user2",
"added": [             # order doesn't matter
    "partial_submissions",
    "add_submissions", 
    {
         "code": "view_submissions",
          "filters": [
                {"_submitted_by": "user2"}
          ],
    },
    {
         "code": "add_submissions",
          "filters": [
                {"_submitted_by": "user2"}
          ],
    },
    {
         "code": "change_submissions",
          "filters": [
                {"_submitted_by": "user2"}
          ],
    },
], 
"removed":["change_asset"]
}

23. Click the trashcan next to "user2" to remove all permissions
24. 🟢 Reload the endpoint. Deletion will actually be 2 delete, requests, so you'll end up with 2 new ph logs with

metadata['permissions'] =
{
"username": "user2",
"added": [],  
"removed": ["partial_submissions", "view_asset"]    # order doesn't matter
}

and

metadata['permissions'] =
{
"username": "user2",
"added": [],  
"removed":["add_submissions"]
}

25. Copy the following into a tmp.json file (unless you really want to type the whole json into the command line):

[
    {
	"user":"http://localhost/api/v2/users/user2/",
	"permission": "http://localhost/api/v2/permissions/add_submissions/"
    },
    {
	"user": "http://localhost/api/v2/users/user3/",
	"permission": "http://localhost/api/v2/permissions/view_asset/"
    }
 
]

26. In a terminal, run curl -v -X POST -H "Content-Type: application/json" -H "Authorization: Token <your token>" http://localhost/api/v2/assets/<asset_uid>/permission-assignments/bulk/?format=json -d @/tmp.json
27. 🟢 Reload the endpoint. You should see 2 new PH logs, one with the new permissions for user2 and one for user3.

💭 Notes

This PR does a lot:

1. Update assign_perm to call post_assign_perm right after we create the ObjectPermission object. This way it is called when we assign implied permissions as well. There's only one other thing listening to the signal and it only cares about when we grant anonymous users the 'add_submission' permission.
2. Update remove_perm to call post_remove_perm iff we actually delete anything
3. Add new signals for adding/removing partial permissions objects
4. Listen for permission signals. Add permissions added/removed to the request in a dictionary keyed by username. We get the request from get_current_request because passing the request around wherever permissions might change is too complicated and would require at least one major refactor.
5. At the end of the request, assuming it succeeded, use the dictionaries stored on the request object to create PH logs for each user whose permissions were updated

Additional notes:
Partial permissions are handled a bit differently than normal ones since they are not additive. Every time we set partial permissions, we're wiping away any old partial permissions.

I tried to be thorough in the unit tests but there are a LOT of different ways permissions can change, especially with a bulk request.

This PR purposely leaves out changes that result from collection actions. Those will be dealt with later. Similarly, the PR does not handle the v1 endpoint or requests to transfer ownership.

[noliveleger]

LGTM, although I haven't done an in-depth review. I leave that to Guillermo.
Just left some aesthetic comments.

[noliveleger]

typo ;-)

[noliveleger]

A -> Z 🙏

[rgraber]

I'm going to alphabetize everything in one big PR after all the functionality is done

[noliveleger]

Should it be PERM_PARTIAL_SUBMISSIONS? or you did it in purpose because of your test?
If it is the latter, you should add a comment because PERM_VIEW_ASSET should never be added with partial perms.

[rgraber]

In this case it doesn't matter since I'm just testing the signal, not actually adding permissions to anything.

[Guitlle]

Made some minor suggestions via chat, the rest of functionality and code looks great, and it works like a charm.