Relabel existing permissions

Since we have added a new, 5th permission the existing permissions
should be relabelled so that the five make sense as a coherent set.

We especially want to make sure that:
- the labels work against the checkboxes and against the tick/crosses on
  the manage users page (a long time ago this page was layed out
  differently so didn’t have space for full labels)
- there is no confusion between usage and reports

This commit also:
- re-adds a line about what all users can see (‘sent messages’) but
  continues to omit the additional bullet points about templates and
  team members (because we think this is clear enough from reading the
  permissions)
- refactors the `Form` subclass so that the content and order of the
  permissions only have to be defined once
- brings back the ‘permissions’ legend on the `fieldset`

app/main/forms.py

@@ -40,7 +40,7 @@ from app.main.validators import (
     ValidEmail,
     ValidGovEmail,
 )
-from app.notify_client.models import roles
+from app.notify_client.models import permissions, roles
 from app.utils import guess_name_from_email_address
 
 
@@ -256,13 +256,12 @@ class RegisterUserFromOrgInviteForm(StripWhitespaceForm):
     auth_type = HiddenField('auth_type', validators=[DataRequired()])
 
 
-class PermissionsForm(StripWhitespaceForm):
+PermissionsAbstract = type("PermissionsAbstract", (StripWhitespaceForm,), {
+    permission: BooleanField(label) for permission, label in permissions
+})
 
-    view_activity = BooleanField("See dashboard and reports")
-    send_messages = BooleanField("Send messages")
-    manage_templates = BooleanField("Add and edit templates")
-    manage_service = BooleanField("Manage this service and its team")
-    manage_api_keys = BooleanField("Manage API keys")
+
+class PermissionsForm(PermissionsAbstract):
 
     login_authentication = RadioField(
         'Sign in using',
@@ -277,6 +276,10 @@ class PermissionsForm(StripWhitespaceForm):
     def permissions(self):
         return {role for role in roles.keys() if self[role].data is True}
 
+    @property
+    def permissions_fields(self):
+        return (getattr(self, permission) for permission, _ in permissions)
+
     @classmethod
     def from_user(cls, user, service_id):
         return cls(

app/main/views/manage_users.py

@@ -10,6 +10,7 @@ from app import (
 )
 from app.main import main
 from app.main.forms import InviteUserForm, PermissionsForm, SearchUsersForm
+from app.notify_client.models import permissions
 from app.utils import user_has_permissions
 
 
@@ -31,6 +32,7 @@ def manage_users(service_id):
         current_user=current_user,
         show_search_box=(len(users) > 7),
         form=SearchUsersForm(),
+        permissions=permissions,
     )
 
 

app/notify_client/models.py

@@ -20,6 +20,14 @@ roles_by_permission = {
 
 all_permissions = set(roles_by_permission.values())
 
+permissions = (
+    ('view_activity', 'See dashboard and reports'),
+    ('send_messages', 'Send messages using templates'),
+    ('manage_templates', 'Add and edit templates'),
+    ('manage_service', 'Manage settings, team members and usage'),
+    ('manage_api_keys', 'Manage API integration'),
+)
+
 
 def _get_service_id_from_view_args():
     return request.view_args.get('service_id', None)

app/templates/views/manage-users.html

@@ -63,26 +63,12 @@
         </h3>
         <ul class="tick-cross-list">
           <div class="tick-cross-list-permissions">
-            {{ tick_cross(
-              user.has_permission_for_service(current_service.id, 'view_activity'),
-              'See dashboard and reports'
-            ) }}
-            {{ tick_cross(
-              user.has_permission_for_service(current_service.id, 'send_messages'),
-              'Send messages'
-            ) }}
-            {{ tick_cross(
-              user.has_permission_for_service(current_service.id, 'manage_templates'),
-              'Add and edit templates'
-            ) }}
-            {{ tick_cross(
-              user.has_permission_for_service(current_service.id, 'manage_service'),
-              'Manage service'
-            ) }}
-            {{ tick_cross(
-              user.has_permission_for_service(current_service.id, 'manage_api_keys'),
-              'Access API keys'
-            ) }}
+            {% for permission, label in permissions %}
+              {{ tick_cross(
+                user.has_permission_for_service(current_service.id, permission),
+                label
+              ) }}
+            {% endfor %}
             {% if current_service.has_permission('email_auth') %}
               <div class="tick-cross-list-hint">
                 {% if user.auth_type == 'sms_auth' %}

app/templates/views/manage-users/permissions.html

@@ -2,16 +2,18 @@
 {% from "components/radios.html" import radio, radios, radios_wrapper, conditional_radio_panel %}
 
 <fieldset class="form-group">
-  <legend class="form-label visually-hidden">
+  <legend class="form-label">
     Permissions
   </legend>
-  {{ checkbox(form.view_activity) }}
-  {{ checkbox(form.send_messages) }}
-  {{ checkbox(form.manage_templates) }}
-  {{ checkbox(form.manage_service) }}
-  {{ checkbox(form.manage_api_keys) }}
+  {% for field in form.permissions_fields %}
+    {{ checkbox(field) }}
+  {% endfor %}
 </fieldset>
 
+<p class="bottom-gutter">
+  All team members can see sent messages.
+</p>
+
 {% if service_has_email_auth %}
   {% if user_has_no_mobile_number %}
     {{ radios(