darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-08 01:38:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

add restrict_admin_usage arg to admin_override

Browse Source 
rather than allow admins to do everything specifically, we should
only block them from things we conciously don't want them to do.
This is "Don't let platform admins send letters from services they're
not in". Everything else the platform admins can do.

This is step one, adding a restrict_admin_usage flag, and setting that
for those restricted endpoints around creating api keys, uploading CSVs
and sending one-off messages.

Also, this commit separates the two use cases for permissions:
* user.has_permission for access control
* user.has_permission_for_service for user info - this is used for
  showing checkboxes on the manage-users page for example

With this, we can remove the admin_override flag from the permission
decorator.
This commit is contained in:
Leo Hemsted
2018-02-28 18:13:29 +00:00
parent 09824078dd
commit 3ae815528c
12 changed files with 42 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/templates/views/dashboard/dashboard.html
View File

@@ -19,7 +19,7 @@
{% if not templates %}
{% include 'views/dashboard/write-first-messages.html' %}
{% endif %}
{% elif not current_user.has_permissions('send_messages', 'manage_api_keys', any_=True) %}
{% elif not current_user.has_permissions('send_messages', 'manage_api_keys', any_=True, admin_override=True) %}
{% include 'views/dashboard/no-permissions-banner.html' %}
{% endif %}

8
app/templates/views/manage-users.html
View File

@@ -64,19 +64,19 @@
<ul class="tick-cross-list">
<div class="tick-cross-list-permissions">
{{ tick_cross(
user.has_permissions('send_messages'),
user.has_permission_for_service(current_service.id, 'send_messages'),
'Send messages'
) }}
{{ tick_cross(
user.has_permissions('manage_templates'),
user.has_permission_for_service(current_service.id, 'manage_templates'),
'Add and edit templates'
) }}
{{ tick_cross(
user.has_permissions('manage_service'),
user.has_permission_for_service(current_service.id, 'manage_service'),
'Manage service'
) }}
{{ tick_cross(
user.has_permissions('manage_api_keys'),
user.has_permission_for_service(current_service.id, 'manage_api_keys'),
'Access API keys'
) }}
{% if 'email_auth' in current_service['permissions'] %}

2
app/templates/views/service-settings.html
View File

@@ -227,7 +227,7 @@
</ul>
<p>
{% if current_user.has_permissions('manage_service') %}
{% if current_user.has_permissions('manage_service', admin_override=True) %}
To remove these restrictions
<a href="{{ url_for('.request_to_go_live', service_id=current_service.id) }}">request to go live</a>.
{% else %}

2
app/templates/views/templates/_template.html
View File

@@ -6,7 +6,7 @@
{% else %}
<div class="bottom-gutter-2-3">
<div class="grid-row">
{% if current_user.has_permissions('send_messages') %}
{% if current_user.has_permissions('send_messages', restrict_admin_usage=True) %}
<div class="{{ 'column-half' if template.template_type == 'letter' else 'column-third' }}">
<a href="{{ url_for(".send_messages", service_id=current_service.id, template_id=template.id) }}" class="pill-separate-item">
Upload recipients