list_editable should respect per-object permissions

[Jeremy Dunck]

Currently, list_editable for admin displays form fields for all objects, even if an auth backend supports per-object permissions.

This allows editing of objects even if the user shouldn't be able to.

If there's a backend that supports per-object permissions, only those rows which allow editing should have edit fields.

I think this means that FormSet created in changelist_view needs to be passed a result_list which is annotated with per-object permission flags, and modelform_factory should respect those flags.

[Julien Phalip]

Yes, this makes a lot of sense. The trick will be to annotate the result list in a way that doesn't impact performance too much.

[Aymeric Augustin]

Change UI/UX from NULL to False.

[Aymeric Augustin]

Change Easy pickings from NULL to False.

[Artyom Kotovskiy]

PR for this -> ​https://github.com/django/django/pull/19743

[Jacob Walls]

Would be good to have merge conflicts fixed before re-review.

[Jacob Walls <jacobtylerwalls@…>]

In 512e348b:

Refs #15759 -- Factored out _save_formset() in ModelAdmin.

[Jacob Walls <jacobtylerwalls@…>]

In 84db026:

Fixed #15759 -- Excluded fields by per-object permissions for ModelAdmin.list_editable.

Instead of going over all objects in a queryset and filtering
by user permissions, added skipping while saving the formset
so there is no need to refetch objects again.

[Tim Graham]

​Follow up PR

[Jacob Walls <jacobtylerwalls@…>]

In 5b3cfce:

Refs #15759 -- Fixed ModelAdmin.list_editable form submission for non-editable instances.

Added formset that excludes objects for which
user has no permission for POST formset as well.

Fixed regression test: the test was not simulating
real behaviour properly. By providing full form
data for the post request we skipped the part
where the user was actually limited in permissions
and only modified some of the rows.

Improved tests by getting rid of obj.id % 2
approach for granting permissions per object
for users, since it is not the safest.
Instead granting permissions simply by 'alive'
parameter, which is simpler and more stable.

Bug in 84db026228413dda4cd195464554d51c0b208e32.