Merge pull request #3520 from alphagov/broadcast-user-permissions

Make user permissions make sense for services with the broadcast permission

app/main/forms.py

@@ -54,7 +54,11 @@ from app.main.validators import (
 )
 from app.models.feedback import PROBLEM_TICKET_TYPE, QUESTION_TICKET_TYPE
 from app.models.organisation import Organisation
-from app.models.roles_and_permissions import permissions, roles
+from app.models.roles_and_permissions import (
+    broadcast_permissions,
+    permissions,
+    roles,
+)
 from app.utils import guess_name_from_email_address
 
 
@@ -493,7 +497,12 @@ PermissionsAbstract = type("PermissionsAbstract", (StripWhitespaceForm,), {
 })
 
 
-class PermissionsForm(PermissionsAbstract):
+BroadcastPermissionsAbstract = type("BroadcastPermissionsAbstract", (StripWhitespaceForm,), {
+    permission: BooleanField(label) for permission, label in broadcast_permissions
+})
+
+
+class BasePermissionsForm(StripWhitespaceForm):
     def __init__(self, all_template_folders=None, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.folder_permissions.choices = []
@@ -517,11 +526,14 @@ class PermissionsForm(PermissionsAbstract):
 
     @property
     def permissions(self):
-        return {role for role in roles.keys() if self[role].data is True}
+        return {field.id for field in self.permissions_fields if field.data is True}
 
     @property
     def permissions_fields(self):
-        return (getattr(self, permission) for permission, _ in permissions)
+        return (
+            getattr(self, permission) for permission, field in self.__dict__.items()
+            if isinstance(field, BooleanField)
+        )
 
     @classmethod
     def from_user(cls, user, service_id, **kwargs):
@@ -535,7 +547,18 @@ class PermissionsForm(PermissionsAbstract):
         )
 
 
-class InviteUserForm(PermissionsForm):
+class PermissionsForm(PermissionsAbstract, BasePermissionsForm):
+    pass
+
+
+class BroadcastPermissionsForm(BroadcastPermissionsAbstract, BasePermissionsForm):
+
+    @property
+    def permissions(self):
+        return {'view_activity'} | super().permissions
+
+
+class BaseInviteUserForm():
     email_address = email_address(gov_user=False)
 
     def __init__(self, invalid_email_address, *args, **kwargs):
@@ -547,6 +570,14 @@ class InviteUserForm(PermissionsForm):
             raise ValidationError("You cannot send an invitation to yourself")
 
 
+class InviteUserForm(BaseInviteUserForm, PermissionsForm):
+    pass
+
+
+class BroadcastInviteUserForm(BaseInviteUserForm, BroadcastPermissionsForm):
+    pass
+
+
 class InviteOrgUserForm(StripWhitespaceForm):
     email_address = email_address(gov_user=False)
 

app/main/views/manage_users.py

@@ -18,6 +18,8 @@ from app.event_handlers import (
 )
 from app.main import main
 from app.main.forms import (
+    BroadcastInviteUserForm,
+    BroadcastPermissionsForm,
     ChangeEmailForm,
     ChangeMobileNumberForm,
     ChangeNonGovEmailForm,
@@ -25,7 +27,7 @@ from app.main.forms import (
     PermissionsForm,
     SearchUsersForm,
 )
-from app.models.roles_and_permissions import permissions
+from app.models.roles_and_permissions import broadcast_permissions, permissions
 from app.models.user import InvitedUser, User
 from app.utils import is_gov_user, redact_mobile_number, user_has_permissions
 
@@ -39,7 +41,9 @@ def manage_users(service_id):
         current_user=current_user,
         show_search_box=(len(current_service.team_members) > 7),
         form=SearchUsersForm(),
-        permissions=permissions,
+        permissions=(
+            broadcast_permissions if current_service.has_permission('broadcast') else permissions
+        ),
     )
 
 
@@ -47,7 +51,12 @@ def manage_users(service_id):
 @user_has_permissions('manage_service')
 def invite_user(service_id):
 
-    form = InviteUserForm(
+    if current_service.has_permission('broadcast'):
+        form_class = BroadcastInviteUserForm
+    else:
+        form_class = InviteUserForm
+
+    form = form_class(
         invalid_email_address=current_user.email_address,
         all_template_folders=current_service.all_template_folders,
         folder_permissions=[f['id'] for f in current_service.all_template_folders]
@@ -89,7 +98,12 @@ def edit_user_permissions(service_id, user_id):
     if user.mobile_number:
         mobile_number = redact_mobile_number(user.mobile_number, " ")
 
-    form = PermissionsForm.from_user(
+    if current_service.has_permission('broadcast'):
+        form_class = BroadcastPermissionsForm
+    else:
+        form_class = PermissionsForm
+
+    form = form_class.from_user(
         user,
         service_id,
         folder_permissions=None if user.platform_admin else [

app/models/roles_and_permissions.py

@@ -25,6 +25,12 @@ permissions = (
     ('manage_api_keys', 'Manage API integration'),
 )
 
+broadcast_permissions = (
+    ('send_messages', 'Prepare and approve broadcasts'),
+    ('manage_templates', 'Add and edit templates'),
+    ('manage_service', 'Manage settings and team'),
+)
+
 
 def translate_permissions_from_db_to_admin_roles(permissions):
     """