Soft delete election

[benadida]

fixes #161 by implementing soft delete.

At some point we'll garbage collect the soft-deleted elections.

[Copilot]

Pull request overview

This pull request implements soft delete functionality for elections by adding a deleted_p flag and deleted_at timestamp. Soft-deleted elections are hidden from default queries but remain accessible to administrators via direct UUID or short name lookups.

Changes:

• Added soft delete fields (deleted_p, deleted_at) to the Election model with custom manager to filter deleted elections by default
• Implemented soft_delete() and undelete() methods on the Election model with logging support
• Added a new delete view endpoint with POST/CSRF protection for deleting/undeleting elections
• Added comprehensive test coverage for the soft delete functionality

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
helios/models.py	Added ElectionManager custom manager, deleted_p and deleted_at fields, soft_delete()/undelete() methods, updated get_by_uuid() and get_by_short_name() to use objects_with_deleted, added DELETED/UNDELETED log constants
helios/views.py	Added one_election_delete() view with POST requirement and CSRF protection to soft delete/undelete elections
helios/tests.py	Added test_soft_delete() model test and ElectionDeleteViewTests class with comprehensive view tests
helios/migrations/0008_add_election_soft_delete.py	Migration to add deleted_p and deleted_at fields to Election model
helios/election_urls.py	Added route for /delete endpoint
helios/election_url_names.py	Added ELECTION_DELETE URL name constant

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The delete endpoint only performs the delete/undelete action when the request method is POST, but it always redirects to the election view page regardless of the request method. For GET requests, no action is taken but the user is still redirected. This behavior differs from typical patterns where GET requests without actions might return an error or show a confirmation page. Consider either requiring POST or handling GET requests explicitly (e.g., showing an error or confirmation page).

Suggested change

	if request.method == "POST":
	check_csrf(request)
	delete_p = request.POST.get('delete_p', '1')
	if bool(int(delete_p)):
	election.soft_delete()
	else:
	election.undelete()
	if request.method != "POST":
	return HttpResponseBadRequest("Delete/undelete election requires POST.")
	check_csrf(request)
	delete_p = request.POST.get('delete_p', '1')
	if bool(int(delete_p)):
	election.soft_delete()
	else:
	election.undelete()