As a stall submitter, I want to be able to edit my stall once I've submitted it, so that I can update the stall details myself if something changes.

As a stall approver, I want to be able to see which pieces of stall information have changed since we approved it, so that I can more easily decide which changes to apply to the polling place.

Problem

Currently there's no process for stall editing via the website. Users have to email us directly and we have to manually apply edits via the Polling Place Editor.

For the 2018 Victorian election we had 40-odd requests for updates to stalls that we had to manually process and respond to ourselves. That's no good - let's optimise that!

Proposal

Stall Approval

[x] Add an approved_on datetimestamp to stalls that is updated when a stall is approved (views.py or signals.py?)
[x] Check that IP-based history is actually enabled and working (a quick glance suggests not)

Stall Submitted/Approval Email

~Re-purpose the mail_confirm_key code for the confirm_key for the stall approval URL~
[x] Do HMAC properly using the stall_id and election_id as the message
[x] Create a URL on the public site like https://democracysausage.org/edit-stall/?confirm_key=foobar
[x] Update the stall submitted and stall approval email templates to include the new URL and a blurb about stall updates

Stalls API

[x] Add an endpoint that checks that a given confirm_key is valid and isn't super old (?) when the stall page is loaded. Also that the election is still live.

Stall Edit Form

[x] Check the confirm_key validation endpoint on componentDidMount
[x] If invalid, display a message
If valid:
- [x] Display a summary of the polling place it is attached to as an information card
- [x] If it's an unofficial stall that hasn't yet been approved, display the stall_location_info
- [x] If not yet approved, display a banner noting this
- [x] Display a stall editing form with the information currently in stalls (be it approved or otherwise - so they can edit yet-to-be-approved stalls). Consider re-using the same component as Add Stall, just with a different Container. The user won't be able to edit the stall location or their email.
- [x] Apply client-side form validation logic per the Add Stall form
- [x] Apply backend form validation logic per the Add Stall form If the edits are valid:
- [x] Set the stall's status to Pending (regardless of what it was before) If the edits are saved successfully:
- [x] Display a message similar to the Add Stall message so the user knows it won't appear on the map straightaway

QAing an Edited Stall

[x] Display a banner indicating this stall was edited since it was approved
[x] Mark or highlight any stall fields that changed since it was last approved (using django-simple-history) and the approved_on datetimestamp. This should allow us to capture multiple edits to a stall between approvals.
[x] If the stall has never been approved, don't show the banner and don't show the diff. (Treat it like a regular stall.)
[x] If the stall is approved, apply the usual logic (from part 1 above) except for the email template. Use a new "your stall has been updated" template that says something like "If this wasn't you, please email ausdemocracysausage@gmail.com and let them know!". Include all of the information that was approved (current state - no diffing).
[x] If the stall is declined, still apply the usual workflow?

Other

~Add a way for us to get the edit stall URL for a stall so we can easily send it to people to self-serve who don't realise they can edit their own stalls~

Deploying

[x] Update env vars on PROD
[x] Update Google Cloud Console
[x] Update and test Mailgun webhooks
[x] Run UPDATE demsausage.app_elections SET election_day = election_day + interval '-16 hour';
[x] Run UPDATE demsausage.app_stalls SET approved_on = reported_timestamp WHERE status = 'Approved';
[x] Check cookies
[x] Check POSTs and PATCHes on both sites
[x] Check mail opt out (junk my historical stalls first - if any)

keithamoss / demsausage

Users who submit stalls should be able to edit them again #17