add restrict_admin_usage arg to admin_override

rather than allow admins to do everything specifically, we should
only block them from things we conciously don't want them to do.
This is "Don't let platform admins send letters from services they're
not in". Everything else the platform admins can do.

This is step one, adding a restrict_admin_usage flag, and setting that
for those restricted endpoints around creating api keys, uploading CSVs
and sending one-off messages.

Also, this commit separates the two use cases for permissions:
* user.has_permission for access control
* user.has_permission_for_service for user info - this is used for
  showing checkboxes on the manage-users page for example

With this, we can remove the admin_override flag from the permission
decorator.

app/main/views/api_keys.py

@@ -86,7 +86,7 @@ def api_keys(service_id):
 
 @main.route("/services/<service_id>/api/keys/create", methods=['GET', 'POST'])
 @login_required
-@user_has_permissions('manage_api_keys')
+@user_has_permissions('manage_api_keys', restrict_admin_usage=True)
 def create_api_key(service_id):
     key_names = [
         key['name'] for key in api_key_api_client.get_api_keys(service_id=service_id)['apiKeys']

app/main/views/manage_users.py

@@ -80,7 +80,7 @@ def edit_user_permissions(service_id, user_id):
     user_has_no_mobile_number = user.mobile_number is None
 
     form = PermissionsForm(
-        **{role: user.has_permissions(role) for role in roles.keys()},
+        **{role: user.has_permission_for_service(service_id, role) for role in roles.keys()},
         login_authentication=user.auth_type
     )
     if form.validate_on_submit():
@@ -109,7 +109,7 @@ def remove_user_from_service(service_id, user_id):
     # Need to make the email address read only, or a disabled field?
     # Do it through the template or the form class?
     form = PermissionsForm(**{
-        role: user.has_permissions(role) for role in roles.keys()
+        role: user.has_permission_for_service(service_id, role) for role in roles.keys()
     })
 
     if request.method == 'POST':

app/main/views/send.py

@@ -601,7 +601,7 @@ def check_messages(service_id, template_type, upload_id, row_index=2):
 @main.route("/services/<service_id>/<template_type>/check/<upload_id>.<filetype>", methods=['GET'])
 @main.route("/services/<service_id>/<template_type>/check/<upload_id>/row-<int:row_index>.<filetype>", methods=['GET'])
 @login_required
-@user_has_permissions('send_messages')
+@user_has_permissions('send_messages', restrict_admin_usage=True)
 def check_messages_preview(service_id, template_type, upload_id, filetype, row_index=2):
     if filetype not in ('pdf', 'png'):
         abort(404)
@@ -615,7 +615,7 @@ def check_messages_preview(service_id, template_type, upload_id, filetype, row_i
 @main.route("/services/<service_id>/<template_type>/check/<upload_id>", methods=['POST'])
 @main.route("/services/<service_id>/<template_type>/check/<upload_id>/row-<int:row_index>", methods=['POST'])
 @login_required
-@user_has_permissions('send_messages')
+@user_has_permissions('send_messages', restrict_admin_usage=True)
 def recheck_messages(service_id, template_type, upload_id, row_index=0):
 
     if not session.get('upload_data'):
@@ -626,7 +626,7 @@ def recheck_messages(service_id, template_type, upload_id, row_index=0):
 
 @main.route("/services/<service_id>/start-job/<upload_id>", methods=['POST'])
 @login_required
-@user_has_permissions('send_messages')
+@user_has_permissions('send_messages', restrict_admin_usage=True)
 def start_job(service_id, upload_id):
     upload_data = session['upload_data']
 
@@ -658,7 +658,7 @@ def start_job(service_id, upload_id):
 
 @main.route("/services/<service_id>/end-tour/<example_template_id>")
 @login_required
-@user_has_permissions('manage_templates')
+@user_has_permissions('manage_templates', admin_override=True)
 def go_to_dashboard_after_tour(service_id, example_template_id):
 
     service_api_client.delete_service_template(service_id, example_template_id)
@@ -767,7 +767,7 @@ def get_back_link(service_id, template_id, step_index):
 
 @main.route("/services/<service_id>/template/<template_id>/notification/check", methods=['GET'])
 @login_required
-@user_has_permissions('send_messages')
+@user_has_permissions('send_messages', admin_override=True)
 def check_notification(service_id, template_id):
     return _check_notification(service_id, template_id)