From 103a36a5da3f4d5279f860519dceecabecd6e69e Mon Sep 17 00:00:00 2001
From: Chris Hill-Scott <me@quis.cc>
Date: Thu, 22 Feb 2018 13:13:57 +0000
Subject: [PATCH] =?UTF-8?q?Hide=20=E2=80=98request=20to=20go=20live?=
 =?UTF-8?q?=E2=80=99=20from=20API=20only=20users?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Users who have the ‘manage API keys’ permission can see the settings
page. But they don’t have permission to request to go live.

At the moment they can still see the link, though clicking it gives them
a 403 error. This commit changes it so that they can’t see the link, and
tells them who they should speak to about going live (their manager).
---
 app/templates/views/service-settings.html     | 13 ++++--
 tests/app/main/views/test_service_settings.py | 46 +++++++++++++++----
 tests/conftest.py                             | 25 ++++++++++
 3 files changed, 72 insertions(+), 12 deletions(-)

diff --git a/app/templates/views/service-settings.html b/app/templates/views/service-settings.html
index bce3f0ad6..7c4adc14b 100644
--- a/app/templates/views/service-settings.html
+++ b/app/templates/views/service-settings.html
@@ -227,9 +227,14 @@
       </ul>
 
       <p>
-        To remove these restrictions
-        <a href="{{ url_for('.request_to_go_live', service_id=current_service.id) }}">request to go live</a>.
-      </p>
+        {% if current_user.has_permissions('manage_settings') %}
+          To remove these restrictions
+          <a href="{{ url_for('.request_to_go_live', service_id=current_service.id) }}">request to go live</a>.
+        {% else %}
+          Your service manager can ask to have these restrictions removed.
+        {% endif %}
+        </p>
+
     {% else %}
       <h2 class="heading-medium">Your service is live</h2>
 
@@ -328,7 +333,7 @@
             <a href="{{ url_for('.service_switch_can_send_precompiled_letter', service_id=current_service.id) }}" class="button">
               {{ 'Stop sending precompiled letters' if 'precompiled_letter' in current_service.permissions else 'Allow to send precompiled letters' }}
             </a>
-          </li>  
+          </li>
         {% endif %}
         <li class="bottom-gutter">
           <a href="{{ url_for('.service_switch_email_auth', service_id=current_service.id) }}" class="button">
diff --git a/tests/app/main/views/test_service_settings.py b/tests/app/main/views/test_service_settings.py
index 34a0392f6..e7e945a87 100644
--- a/tests/app/main/views/test_service_settings.py
+++ b/tests/app/main/views/test_service_settings.py
@@ -11,6 +11,7 @@ from tests import validate_route_permission, service_json
 from tests.conftest import (
     active_user_with_permissions,
     active_user_no_api_key_permission,
+    active_user_no_settings_permission,
     platform_admin_user,
     normalize_spaces,
     multiple_reply_to_email_addresses,
@@ -281,20 +282,49 @@ def test_should_redirect_after_change_service_name(
     assert mock_service_name_is_unique.called
 
 
+@pytest.mark.parametrize('user, expected_text, expected_link', [
+    (
+        active_user_with_permissions,
+        'To remove these restrictions request to go live.',
+        True,
+    ),
+    (
+        active_user_no_settings_permission,
+        'Your service manager can ask to have these restrictions removed.',
+        False,
+    ),
+])
 def test_show_restricted_service(
-        logged_in_client,
-        service_one,
-        single_reply_to_email_address,
-        single_letter_contact_block,
-        mock_get_service_organisation,
-        single_sms_sender,
-        mock_get_service_settings_page_common,
+    client,
+    mocker,
+    fake_uuid,
+    service_one,
+    single_reply_to_email_address,
+    single_letter_contact_block,
+    mock_get_service_organisation,
+    single_sms_sender,
+    mock_get_service_settings_page_common,
+    user,
+    expected_text,
+    expected_link,
 ):
-    response = logged_in_client.get(url_for('main.service_settings', service_id=service_one['id']))
+    client.login(user(fake_uuid), mocker, service_one)
+    response = client.get(url_for('main.service_settings', service_id=service_one['id']))
     page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
     assert page.find('h1').text == 'Settings'
     assert page.find_all('h2')[0].text == 'Your service is in trial mode'
 
+    request_to_live = page.select_one('main p')
+    request_to_live_link = request_to_live.select_one('a')
+
+    assert normalize_spaces(request_to_live.text) == expected_text
+
+    if expected_link:
+        assert request_to_live_link.text.strip() == 'request to go live'
+        assert request_to_live_link['href'] == url_for('main.request_to_go_live', service_id=service_one['id'])
+    else:
+        assert not request_to_live_link
+
 
 def test_switch_service_to_live(
         logged_in_platform_admin_client,
diff --git a/tests/conftest.py b/tests/conftest.py
index 819df1fa3..f944c5cc4 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -1261,6 +1261,31 @@ def active_user_no_api_key_permission(fake_uuid):
     return user
 
 
+@pytest.fixture
+def active_user_no_settings_permission(fake_uuid):
+    from app.notify_client.user_api_client import User
+
+    user_data = {
+        'id': fake_uuid,
+        'name': 'Test User With Permissions',
+        'password': 'somepassword',
+        'password_changed_at': str(datetime.utcnow()),
+        'email_address': 'test@user.gov.uk',
+        'mobile_number': '07700 900762',
+        'state': 'active',
+        'failed_login_count': 0,
+        'permissions': {SERVICE_ONE_ID: [
+            'manage_templates',
+            'manage_api_keys',
+            'view_activity',
+        ]},
+        'platform_admin': False,
+        'auth_type': 'sms_auth'
+    }
+    user = User(user_data)
+    return user
+
+
 @pytest.fixture(scope='function')
 def api_user_locked(fake_uuid):
     from app.notify_client.user_api_client import User