Merge pull request #2510 from alphagov/fix-user-with-no-permissions

Fix the permission check for users without permissions.

tests/app/main/test_permissions.py

@@ -211,6 +211,22 @@ def test_user_doesnt_have_permissions_for_organisation(
         index()
 
 
+def test_user_with_no_permissions_to_service_goes_to_templates(
+        client,
+        mocker
+):
+    user = _user_with_permissions()
+    mocker.patch('app.user_api_client.get_user', return_value=user)
+    client.login(user)
+    request.view_args = {'service_id': 'bar'}
+
+    @user_has_permissions()
+    def index():
+        pass
+
+    index()
+
+
 def _user_with_permissions():
     from app.notify_client.user_api_client import User
 
@@ -224,6 +240,7 @@ def _user_with_permissions():
                  'permissions': {'foo': ['manage_users', 'manage_templates', 'manage_settings']},
                  'platform_admin': False,
                  'organisations': ['org_1', 'org_2'],
+                 'services': ['foo', 'bar']
                  }
     user = User(user_data)
     return user

tests/app/main/views/test_dashboard.py

@@ -875,6 +875,7 @@ def _test_dashboard_menu(mocker, app_, usr, service, permissions):
     with app_.test_request_context():
         with app_.test_client() as client:
             usr._permissions[str(service['id'])] = permissions
+            usr.services = [service['id']]
             mocker.patch('app.user_api_client.check_verify_code', return_value=(True, ''))
             mocker.patch('app.service_api_client.get_services', return_value={'data': [service]})
             mocker.patch('app.user_api_client.get_user', return_value=usr)

tests/app/main/views/test_templates.py

@@ -1498,7 +1498,7 @@ def test_route_permissions_for_choose_template(
     api_user_active,
     mock_get_template_folders,
     service_one,
-    mock_get_service_templates,
+    mock_get_service_templates
 ):
     mocker.patch('app.job_api_client.get_job')
     validate_route_permission(
@@ -1510,7 +1510,7 @@ def test_route_permissions_for_choose_template(
             'main.choose_template',
             service_id=service_one['id'],
         ),
-        ['view_activity'],
+        [],
         api_user_active,
         service_one)