darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-23 07:46:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

Allow platform admins to cancel broadcasts.

Browse Source 
Do not allow platform admins to:
- create broadcasts
- approve broadcasts
- reject broadcasts

that is, unless they have a send_messages permission
for a given service.

This is so platform admins have the minimum permissions necessary
to cancel a broadcast that might have been sent out accidentally.
This commit is contained in:
Pea Tyczynska
2021-04-06 15:08:47 +01:00
parent 11ded9e828
commit 002dd7485d
3 changed files with 93 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
tests/app/main/views/test_broadcast.py
View File

@@ -93,6 +93,7 @@ def test_broadcast_pages_403_without_permission(
)
@pytest.mark.parametrize('user_is_platform_admin', [True, False])
@pytest.mark.parametrize('endpoint, extra_args, expected_get_status, expected_post_status', (
(
'.new_broadcast', {},
@@ -127,23 +128,27 @@ def test_broadcast_pages_403_without_permission(
'.preview_broadcast_message', {'broadcast_message_id': sample_uuid},
403, 403,
),
(
'.cancel_broadcast_message', {'broadcast_message_id': sample_uuid},
403, 403,
),
))
def test_broadcast_pages_403_for_user_without_permission(
mocker,
client_request,
service_one,
active_user_view_permissions,
platform_admin_user_no_service_permissions,
endpoint,
extra_args,
expected_get_status,
expected_post_status,
user_is_platform_admin
):
"""
Checks that users without permissions, including admin users, cannot create, approve or reject broadcasts.
"""
service_one['permissions'] += ['broadcast']
mocker.patch('app.user_api_client.get_user', return_value=active_user_view_permissions)
if user_is_platform_admin:
client_request.login(platform_admin_user_no_service_permissions)
else:
client_request.login(active_user_view_permissions)
client_request.get(
endpoint,
service_id=SERVICE_ONE_ID,
@@ -158,6 +163,32 @@ def test_broadcast_pages_403_for_user_without_permission(
)
def test_cancel_broadcast_page_403_for_user_without_permission(
mocker,
client_request,
service_one,
active_user_view_permissions,
):
"""
separate test for cancel_broadcast endpoint, because admin users are allowed to cancel broadcasts
"""
service_one['permissions'] += ['broadcast']
mocker.patch('app.user_api_client.get_user', return_value=active_user_view_permissions)
client_request.get(
'.cancel_broadcast_message',
service_id=SERVICE_ONE_ID,
_expected_status=403,
**{'broadcast_message_id': sample_uuid}
)
client_request.post(
'.cancel_broadcast_message',
service_id=SERVICE_ONE_ID,
_expected_status=403,
**{'broadcast_message_id': sample_uuid}
)
@pytest.mark.parametrize('step_index, expected_link_text, expected_link_href', (
(1, 'Continue', partial(url_for, '.broadcast_tour', step_index=2)),
(2, 'Continue', partial(url_for, '.broadcast_tour', step_index=3)),
@@ -2051,15 +2082,25 @@ def test_no_view_page_for_draft(
)
@pytest.mark.parametrize("user_is_platform_admin", [True, False])
def test_cancel_broadcast(
client_request,
service_one,
mock_get_live_broadcast_message,
mock_get_broadcast_template,
mock_update_broadcast_message_status,
platform_admin_user_no_service_permissions,
fake_uuid,
user_is_platform_admin
):
"""
users with 'send_messages' permissions and platform admins should be able to cancel broadcasts.
"""
service_one['permissions'] += ['broadcast']
if user_is_platform_admin:
client_request.login(platform_admin_user_no_service_permissions)
page = client_request.get(
'.cancel_broadcast_message',
service_id=SERVICE_ONE_ID,
@@ -2083,15 +2124,25 @@ def test_cancel_broadcast(
) not in page
@pytest.mark.parametrize("user_is_platform_admin", [True, False])
def test_confirm_cancel_broadcast(
client_request,
service_one,
mock_get_live_broadcast_message,
mock_get_broadcast_template,
mock_update_broadcast_message_status,
platform_admin_user_no_service_permissions,
fake_uuid,
user_is_platform_admin
):
"""
users with 'send_messages' permissions and platform admins should be able to cancel broadcasts.
"""
service_one['permissions'] += ['broadcast']
if user_is_platform_admin:
client_request.login(platform_admin_user_no_service_permissions)
client_request.post(
'.cancel_broadcast_message',
service_id=SERVICE_ONE_ID,