can_undelete permission is not model specific

[wmacbmcd]

If i'm creating two models, and inheriting the meta class on both, a can_undelete permission will be created for each of them.

class ModelA(SoftDeleteObject, models.Model):
    class Meta(SoftDeleteObject.Meta):
        verbose_name = "Model A"

    some_field = models.CharField() 

class ModelB(SoftDeleteObject, models.Model):
    class Meta(SoftDeleteObject.Meta):
        verbose_name = "Model A"

    some_field = models.CharField()

If i then assign the can_undelete permission for ModelA to user1, and assign can_delete for ModelB to user2, both users will be able to undelete ModelA and ModelB objects, because the permission's codename is not unique.

[stvnw]

Furthermore so long as a user has the change_softdeletedrecord and view_changeset permissions, then the user can undelete objects in any model to which the user has only view_<model> permission (at least through the admin). Even though the user may not have change_<model> permission, they are able to effectively change the deleted_at field on said model.