diff --git a/app/main/views/dashboard.py b/app/main/views/dashboard.py index 9d608efca..346d15fc2 100644 --- a/app/main/views/dashboard.py +++ b/app/main/views/dashboard.py @@ -143,7 +143,7 @@ def template_usage(service_id): @main.route("/services//usage") @login_required -@user_has_permissions('manage_service') +@user_has_permissions('manage_service', allow_org_user=True) def usage(service_id): year, current_financial_year = requested_and_current_financial_year(request) diff --git a/app/main/views/manage_users.py b/app/main/views/manage_users.py index 42c3c752b..58cc4846a 100644 --- a/app/main/views/manage_users.py +++ b/app/main/views/manage_users.py @@ -31,7 +31,7 @@ from app.utils import is_gov_user, redact_mobile_number, user_has_permissions @main.route("/services//users") @login_required -@user_has_permissions() +@user_has_permissions(allow_org_user=True) def manage_users(service_id): return render_template( 'views/manage-users.html', diff --git a/app/main/views/organisations.py b/app/main/views/organisations.py index 44d4c068d..78ebfec2d 100644 --- a/app/main/views/organisations.py +++ b/app/main/views/organisations.py @@ -70,13 +70,8 @@ def add_organisation(): @login_required @user_has_permissions() def organisation_dashboard(org_id): - for service in current_organisation.live_services: - has_permission = current_user.has_permission_for_service(service['id'], 'view_activity') - service.update({'has_permission_to_view': has_permission}) - return render_template( 'views/organisations/organisation/index.html', - organisation_services=current_organisation.live_services ) @@ -87,7 +82,6 @@ def organisation_trial_mode_services(org_id): return render_template( 'views/organisations/organisation/trial-mode-services.html', search_form=SearchByNameForm(), - services=current_organisation.trial_services ) diff --git a/app/models/user.py b/app/models/user.py index 0a1fb3ed2..e0e46e620 100644 --- a/app/models/user.py +++ b/app/models/user.py @@ -174,7 +174,7 @@ class User(JSONModel, UserMixin): def platform_admin(self): return self._platform_admin and not session.get('disable_platform_admin_view', False) - def has_permissions(self, *permissions, restrict_admin_usage=False): + def has_permissions(self, *permissions, restrict_admin_usage=False, allow_org_user=False): unknown_permissions = set(permissions) - all_permissions if unknown_permissions: raise TypeError('{} are not valid permissions'.format(list(unknown_permissions))) @@ -193,11 +193,22 @@ class User(JSONModel, UserMixin): return True if org_id: - return org_id in self.organisation_ids - if not permissions: - return service_id in self.service_ids - if service_id: - return any(x in self._permissions.get(service_id, []) for x in permissions) + return self.belongs_to_organisation(org_id) + + if not permissions and self.belongs_to_service(service_id): + return True + + if any( + self.has_permission_for_service(service_id, permission) + for permission in permissions + ): + return True + + from app.models.service import Service + + return allow_org_user and self.belongs_to_organisation( + Service.from_id(service_id).organisation_id + ) def has_permission_for_service(self, service_id, permission): return permission in self._permissions.get(service_id, []) diff --git a/app/templates/main_nav.html b/app/templates/main_nav.html index 543828537..8037b77ff 100644 --- a/app/templates/main_nav.html +++ b/app/templates/main_nav.html @@ -6,15 +6,17 @@ {% if current_user.has_permissions('view_activity') %}
  • Dashboard
  • {% endif %} + {% if current_user.has_permissions() %}
  • Templates
  • - {% if not current_user.has_permissions('view_activity') %} -
  • Sent messages
  • - {% if current_service.has_jobs %} -
  • Uploaded files
  • + {% if not current_user.has_permissions('view_activity') %} +
  • Sent messages
  • + {% if current_service.has_jobs %} +
  • Uploaded files
  • + {% endif %} {% endif %} {% endif %}
  • Team members
  • - {% if current_user.has_permissions('manage_service') %} + {% if current_user.has_permissions('manage_service', allow_org_user=True) %}
  • Usage
  • {% endif %} {% if current_user.has_permissions('manage_api_keys', 'manage_service') %} diff --git a/app/templates/org_nav.html b/app/templates/org_nav.html index fd3cc0c2d..a9f518e11 100644 --- a/app/templates/org_nav.html +++ b/app/templates/org_nav.html @@ -1,6 +1,6 @@