Fix #1008 -- Unassign policies when roles are deleted

[oliverroick]

Proposed changes in this pull request

• Fixes Permissions issue: user changed from DC to PU in a project is still able to add/edit/delete records #1008: As @seav stated in the original bug report, permission policies were not removed from the user's assign policies when a project role is deleted. Policies were also not removed correctly when an organization admin role was deleted (as reported by @linzjax in the comments).
• Introduces a post_delete hook for ProjectRole instances that makes sure policies are unassigned correctly. The functionality to reassign project roles now lives in assign_prj_policies, which is used for both updating and removing project roles.
• Adds changes to assign_org_policies (formerly reassign_user_policies to make sure policies are removed when an organization admin role instance is deleted.
• I also refactored functions related to permission assignment for both organisations and projects to make naming and functionality more consistent:
  • reassign_user_policies renamed to assign_org_policies
  • remove_project_membership renamed to remove_org_permissions
  • assign_org_policies to use delete flag instead of adding
• organization.tests.test_models.ProjectRoleTest was refactored to test whether the policies are assigned to the user instead of specific permissions. This was necessary because the project user policy does not currently contain any permissions; it would not be possible to test if the role is assigned correctly.

When should this PR be merged

ASAP

Risks

None

Follow up actions

None

Checklist (for reviewing)

General

• Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
• Is the PR labeled correctly? It should have the migration label if a new migration is added.
  Is the risk level assessment sufficient? The risks section should contain all risks that might be introduced with the PR and which actions we need to take to mitigate these risks. Possible risks are database migrations, new libraries that need to be installed or changes to deployment scripts.

Functionality

• Are all requirements met? Compare implemented functionality with the requirements specification.
• Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

• Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
• Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
• Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

• Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
• If this is a bug fix, are tests for the issue in place There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.

Documentation

• Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes must be documented in the Cadasta Platform Documentation.
• Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented in the API docs.
• Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

[bjohare]

Minor issue with unused code in ProjectRoleTest. Other than that it looks good to me. Permissions were tested in the UI and using ODK and look correct.

[bjohare]

Doesn't appear to be needed?

[oliverroick]

Indeed, that's removed now.