View constructor required for state transitions

[jace]

A ModelView that implements views for transitions has to do it the manual way: by specifying a route for every transition, each decorated with requires_roles (#179). We currently use a catch all transition view, which cannot benefit from is_available (#217). Instead, the following syntax would be nice:

@route('/path')
class MyView(TransitionView(MyModel.state), ModelView)
    pass

TransitionView constructs a class with a collection of view methods for each of the transitions in the state manager, each of which is decorated with @route (as a POST request) and @requires_roles using the same roles as defined in the source transition. The view performs a CSRF check before calling the transition.

This guide explains how such classes can be constructed in Python.

TransitionView can take optional parameters:

1. prefix, a string prefix for view names
2. suffix, a string suffix for view names
3. forms, a dictionary of {transition_name: form}. The form is used to process data from the request and the fields are passed in to the transition as keyword parameters.
4. exclude a list of transition names for which views should not be constructed
5. include overrides exclude to limit construction to the specified names

[jace]

For safety reasons, transitions that don't specify roles should not be exposed in the view.