Only show relevant user permissions for broadcast services

For services with the broadcast permission this hides:
- the ‘View dashboard’ permission (and defaults it to _checked_) because
  all users of broadcast services will need to see the dashboard
- the ‘Manage API keys’ permission (and defaults it to _not checked_)
  because we don’t offer an API integration for broadcast services yet
  – if we do we won’t want existing users to automatically get the
  permission

It relabels:
- the ‘Send’ permission to ‘Prepare and approve’ to match the current,
  slightly clunky language on the templates page
- the ‘Manage settings’ label to not refer to ‘usage’ because broadcast
  services won’t incur cost

app/main/forms.py

@@ -54,7 +54,11 @@ from app.main.validators import (
 )
 from app.models.feedback import PROBLEM_TICKET_TYPE, QUESTION_TICKET_TYPE
 from app.models.organisation import Organisation
-from app.models.roles_and_permissions import permissions, roles
+from app.models.roles_and_permissions import (
+    broadcast_permissions,
+    permissions,
+    roles,
+)
 from app.utils import guess_name_from_email_address
 
 
@@ -493,7 +497,12 @@ PermissionsAbstract = type("PermissionsAbstract", (StripWhitespaceForm,), {
 })
 
 
-class PermissionsForm(PermissionsAbstract):
+BroadcastPermissionsAbstract = type("BroadcastPermissionsAbstract", (StripWhitespaceForm,), {
+    permission: BooleanField(label) for permission, label in broadcast_permissions
+})
+
+
+class BasePermissionsForm(StripWhitespaceForm):
     def __init__(self, all_template_folders=None, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.folder_permissions.choices = []
@@ -517,11 +526,14 @@ class PermissionsForm(PermissionsAbstract):
 
     @property
     def permissions(self):
-        return {role for role in roles.keys() if self[role].data is True}
+        return {field.id for field in self.permissions_fields if field.data is True}
 
     @property
     def permissions_fields(self):
-        return (getattr(self, permission) for permission, _ in permissions)
+        return (
+            getattr(self, permission) for permission, field in self.__dict__.items()
+            if isinstance(field, BooleanField)
+        )
 
     @classmethod
     def from_user(cls, user, service_id, **kwargs):
@@ -535,7 +547,18 @@ class PermissionsForm(PermissionsAbstract):
         )
 
 
-class InviteUserForm(PermissionsForm):
+class PermissionsForm(PermissionsAbstract, BasePermissionsForm):
+    pass
+
+
+class BroadcastPermissionsForm(BroadcastPermissionsAbstract, BasePermissionsForm):
+
+    @property
+    def permissions(self):
+        return {'view_activity'} | super().permissions
+
+
+class BaseInviteUserForm():
     email_address = email_address(gov_user=False)
 
     def __init__(self, invalid_email_address, *args, **kwargs):
@@ -547,6 +570,14 @@ class InviteUserForm(PermissionsForm):
             raise ValidationError("You cannot send an invitation to yourself")
 
 
+class InviteUserForm(BaseInviteUserForm, PermissionsForm):
+    pass
+
+
+class BroadcastInviteUserForm(BaseInviteUserForm, BroadcastPermissionsForm):
+    pass
+
+
 class InviteOrgUserForm(StripWhitespaceForm):
     email_address = email_address(gov_user=False)
 

app/main/views/manage_users.py

@@ -18,6 +18,8 @@ from app.event_handlers import (
 )
 from app.main import main
 from app.main.forms import (
+    BroadcastInviteUserForm,
+    BroadcastPermissionsForm,
     ChangeEmailForm,
     ChangeMobileNumberForm,
     ChangeNonGovEmailForm,
@@ -47,7 +49,12 @@ def manage_users(service_id):
 @user_has_permissions('manage_service')
 def invite_user(service_id):
 
-    form = InviteUserForm(
+    if current_service.has_permission('broadcast'):
+        form_class = BroadcastInviteUserForm
+    else:
+        form_class = InviteUserForm
+
+    form = form_class(
         invalid_email_address=current_user.email_address,
         all_template_folders=current_service.all_template_folders,
         folder_permissions=[f['id'] for f in current_service.all_template_folders]
@@ -89,7 +96,12 @@ def edit_user_permissions(service_id, user_id):
     if user.mobile_number:
         mobile_number = redact_mobile_number(user.mobile_number, " ")
 
-    form = PermissionsForm.from_user(
+    if current_service.has_permission('broadcast'):
+        form_class = BroadcastPermissionsForm
+    else:
+        form_class = PermissionsForm
+
+    form = form_class.from_user(
         user,
         service_id,
         folder_permissions=None if user.platform_admin else [