Enable soft-locking functionality for media reports to assist simultaneous moderators

[dhruvkb]

Fixes

Fixes #3639 by @sarayourfriend

Description

This PR

1. creates a lock manager to keep lock management utilities separate from the admin
2. highlights reports that are under an active soft-lock in the list view
3. softly locks and unlocks works, using two new admin endpoints at /lock and /unlock, in response to events (including but not limited to loading the change page, switching between tabs or closing the browser)
4. shows a message to any subsequent moderator when they open a work that's soft-locked by someone else
5. times-out soft-locks after 5 minutes (this functionality may be redundant, even harmful, considering point 3 above)

Testing Instructions

This is best tested using two browsers, or two profiles in separate windows of the same browser, or one regular and one incognito session in the same profile of the same browser.

1. In client A, login with admin creds deploy and deploy.
2. In client B, login with moderator creds moderator and deploy. (This was weird when I first learned about it, I expected the password to be the same as the username.)

Test list highlights

...continued

3. In both clients open the list view. You should see no highlighted rows.
4. In client A, click on a report ID and open the change page.
5. Refresh client B to see that row highlighted in yellow.
6. In client A, click on multiple report IDs and open them in separate tabs.
7. Refresh client B to see all those rows highlighted in yellow.

Test other moderator message

...continued

8. In client B, click on the report ID in the highlighted row and open the change page. You should see a message that "deploy" is also looking at the same report.
9. Refresh client A. You should see a message that "moderator" is also looking at the same report.

Test page visibility changes

...continued

10. Close client A to a different tab.
11. Refresh client B, the message about the another moderator should disappear within 10 seconds.
12. Reopen client A to the report tab.
13. Refresh client B, the message should reappear immediately.

Checklist

• My pull request has a descriptive title (not a vague title likeUpdate index.md).
• My pull request targets the default branch of the repository (main) or a parent feature branch.
• My commit messages follow best practices.
• My code follows the established code style of the repository.
• I added or updated tests for the changes I made (if applicable).
• I added or updated documentation (if applicable).
• I tried running the project locally and verified that there are no visible errors.
• I ran the DAG documentation generator (just catalog/generate-docs for catalog
  PRs) or the media properties generator (just catalog/generate-docs media-props
  for the catalog or just api/generate-docs for the API) where applicable.

Developer Certificate of Origin

Developer Certificate of Origin

Developer Certificate of Origin
Version 1.1

Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
1 Letterman Drive
Suite D4700
San Francisco, CA, 94129

Everyone is permitted to copy and distribute verbatim copies of this
license document, but changing it is not allowed.


Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
    have the right to submit it under the open source license
    indicated in the file; or

(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and I have the right under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the same open source license (unless I am
    permitted to submit under a different license), as indicated
    in the file; or

(c) The contribution was provided directly to me by some other
    person who certified (a), (b) or (c) and I have not modified
    it.

(d) I understand and agree that this project and the contribution
    are public and that a record of the contribution (including all
    personal information I submit with it, including my sign-off) is
    maintained indefinitely and may be redistributed consistent with
    this project or the open source license(s) involved.

[sarayourfriend]

Requesting changes due to the keys issue. Otherwise, this LGTM, and generally I am keen on the HTTP request approach! At first, I was sceptical of using HTTP requests to modify the lock, but I see how that accomplishes some interesting things, namely allowing us to detect navigation away even if the moderator closes the Django admin without navigating to another admin page first. It's cool to release the lock in this way.

However, in addition to the keys issue, outlined in my other comment, I think if we used a polling-send approach, we can also fix the tab switching issue, make it possible for a moderator to have a lock on multiple reports (if they have them open), and remove the need to ever manually release the locks.

Basically, this approach would use a very short expiration (lets say 10 seconds), and have the JavaScript send a polling request every 5 seconds. Each request sets the expiration for that work a further 10 seconds into the future. We can prune at this point as well. Setting a lock on one work does not release locks on other works for that same moderator, we only prune expired locks.

I want to emphasise that I think the HTTP request approach is really cool, and it's not one I would have thought of, I think. The use of keys and the improvements to be had by using a poll-send-expire approach instead of a lock/release approach notwithstanding, I was ready to "LGTM, let's merge this despite some nitpicks" on this PR!

[dhruvkb]

Closing in favour of a much more holistic implementation in #4386.