Use API flag to give users access to WebAuthn

This allows us to roll out the feature to other users. Note that
the flag is also "True" if the user has "webauthn_auth" as their
auth type, so this is compatible with the more fine-grained check
we have on the authentication parts of the feature. We could do a
more explicit "can_use_webauthn or webauthn_auth" check here, but
the idea is that we'll be able to get rid of this flag eventually,
so I've optimised for brevity instead.

I've modified a couple of the unhappy-path tests to make it more
explicit that the flag is false, since it can be true for Platform
Admins and "normal users" alike.

app/main/views/user_profile.py

@@ -27,11 +27,7 @@ from app.main.forms import (
     TwoFactorForm,
 )
 from app.models.user import User
-from app.utils.user import (
-    user_is_gov_user,
-    user_is_logged_in,
-    user_is_platform_admin,
-)
+from app.utils.user import user_is_gov_user, user_is_logged_in
 
 NEW_EMAIL = 'new-email'
 NEW_MOBILE = 'new-mob'
@@ -236,8 +232,10 @@ def user_profile_disable_platform_admin_view():
 
 
 @main.route("/user-profile/security-keys", methods=['GET'])
-@user_is_platform_admin
 def user_profile_security_keys():
+    if not current_user.can_use_webauthn:
+        abort(403)
+
     return render_template(
         'views/user-profile/security-keys.html',
     )
@@ -253,8 +251,10 @@ def user_profile_security_keys():
     methods=['GET'],
     endpoint="user_profile_confirm_delete_security_key"
 )
-@user_is_platform_admin
 def user_profile_manage_security_key(key_id):
+    if not current_user.can_use_webauthn:
+        abort(403)
+
     security_key = current_user.webauthn_credentials.by_id(key_id)
 
     if not security_key:
@@ -282,8 +282,9 @@ def user_profile_manage_security_key(key_id):
 
 
 @main.route("/user-profile/security-keys/<uuid:key_id>/delete", methods=['POST'])
-@user_is_platform_admin
 def user_profile_delete_security_key(key_id):
+    if not current_user.can_use_webauthn:
+        abort(403)
 
     try:
         user_api_client.delete_webauthn_credential_for_user(

app/main/views/webauthn_credentials.py

@@ -14,12 +14,13 @@ from app.utils.login import (
     log_in_user,
     redirect_to_sign_in,
 )
-from app.utils.user import user_is_platform_admin
 
 
 @main.route('/webauthn/register')
-@user_is_platform_admin
 def webauthn_begin_register():
+    if not current_user.can_use_webauthn:
+        abort(403)
+
     server = current_app.webauthn_server
 
     registration_data, state = server.register_begin(

app/models/user.py

@@ -31,6 +31,7 @@ class User(JSONModel, UserMixin):
     MAX_FAILED_LOGIN_COUNT = 10
 
     ALLOWED_PROPERTIES = {
+        'can_use_webauthn',
         'id',
         'name',
         'email_address',

app/templates/views/user-profile.html

@@ -45,7 +45,7 @@
         {{ edit_field('Change', url_for('.user_profile_password')) }}
       {% endcall %}
 
-      {% if current_user.platform_admin %}
+      {% if current_user.can_use_webauthn %}
         {% call row(id='security-keys') %}
           {{ text_field('Security keys') }}
           {{ optional_text_field(