Always require an actor_id to identify the user who caused a specific event in a channel's history.

[rtibbles]

Summary

Description of the change(s) you made

Requires any edits to a channel that changed its soft deletion status or creation of a channel to pass the user_id for the user to whom that change should be attributed.
Consolidates all channel history creation and management onto the Channel model.
Adds and updates tests for the channel history.
Updates every instance in the code base that requires the new actor_id parameter.

This does not ensure history is created by queryset updates, or bulk model creation. Neither are used in our backend for channels, and it would be considerably involved to implement.

Locks down all API endpoints to by default only support GET methods (detail and list). Add specific behaviour for those that need to use the REST API for specific actions, and ensure that relevant change events are created.

Updates all tests to reflect this change in the API.

Manual verification steps performed

Tests written to ensure behaviour.

Reviewer guidance

How can a reviewer test these changes?

If the tests pass this should be good to go - I've left it as a draft for now in case I missed anything.

See issue below.

References

Fixes #4148

Comments

---

Contributor's Checklist

PR process:

• If this is an important user-facing change, PR or related issue the CHANGELOG label been added to this PR. Note: items with this label will be added to the CHANGELOG at a later time
• If this includes an internal dependency change, a link to the diff is provided
• The docs label has been added if this introduces a change that needs to be updated in the user docs?
• If any Python requirements have changed, the updated requirements.txt files also included in this PR
• Opportunities for using Google Analytics here are noted
• Migrations are safe for a large db

Studio-specifc:

• All user-facing strings are translated properly
• The notranslate class been added to elements that shouldn't be translated by Google Chrome's automatic translation feature (e.g. icons, user-generated text)
• All UI components are LTR and RTL compliant
• Views are organized into pages, components, and layouts directories as described in the docs
• Users' storage used is recalculated properly on any changes to main tree files
• If there new ways this uses user data that needs to be factored into our Privacy Policy, it has been noted.

Testing:

• Code is clean and well-commented
• Contributor has fully tested the PR manually
• If there are any front-end changes, before/after screenshots are included
• Critical user journeys are covered by Gherkin stories
• Any new interactions have been added to the QA Sheet
• Critical and brittle code paths are covered by unit tests

---

Reviewer's Checklist

This section is for reviewers to fill out.

• Automated test coverage is satisfactory
• PR is fully functional
• PR has been tested for accessibility regressions
• External dependency files were updated if necessary (yarn and pip)
• Documentation is updated
• Contributor is in AUTHORS.md

[akolson]

The code changes look correct to me and tests are passing! Also, manual QA checks out(Instructions in issue). However, it seems that the actor_id is not being captured in the Change model as indicated in the replication steps.

..Query the database for deletion or update related change events

[akolson]

@rtibbles Deletion doesn't seem possible anymore after the latest changes

Screen.Recording.2024-08-07.at.18.18.49.mov

[rtibbles]

I have reinstated the delete endpoint, and updated the test to ensure the channel history object is properly created.

The Change objects will have created_by for the user who made them rather than actor_id.

[akolson]

LGTM! Both code changes and Manual QA checkout! Thanks @rtibbles