darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-06 20:48:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #652 from alphagov/permissions-bug-fix

Browse Source 
Expand permissions before post to api
This commit is contained in:
Adam Shimali
2016-06-07 09:36:50 +01:00
parent 67236d0c2b 813e1c3351
commit 83b1158472
3 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
app/main/views/manage_users.py
View File

@@ -1,5 +1,4 @@
from itertools import chain from itertools import chain
from collections import OrderedDict
from flask import ( from flask import (
request, request,
render_template, render_template,
@@ -35,14 +34,14 @@ roles = {
@login_required @login_required
@user_has_permissions('view_activity', admin_override=True) @user_has_permissions('view_activity', admin_override=True)
def manage_users(service_id): def manage_users(service_id):
users = user_api_client.get_users_for_service(service_id=service_id)
invited_users = [invite for invite in invite_api_client.get_invites_for_service(service_id=service_id)
if invite.status != 'accepted']
return render_template( return render_template(
'views/manage-users.html', 'views/manage-users.html',
users=user_api_client.get_users_for_service(service_id=service_id), users=users,
current_user=current_user, current_user=current_user,
invited_users=[ invited_users=invited_users
invite for invite in invite_api_client.get_invites_for_service(service_id=service_id)
if invite.status != 'accepted'
]
) )
@@ -58,8 +57,10 @@ def invite_user(service_id):
# view_activity is a default role to be added to all users. # view_activity is a default role to be added to all users.
# All users will have at minimum view_activity to allow users to see notifications, # All users will have at minimum view_activity to allow users to see notifications,
# templates, team members but no update privileges # templates, team members but no update privileges
selected_permissions = [role for role in sorted(roles.keys()) if request.form.get(role) == 'y'] selected_permissions = [permissions for role, permissions in roles.items() if request.form.get(role) == 'y']
selected_permissions = list(chain.from_iterable(selected_permissions))
selected_permissions.append('view_activity') selected_permissions.append('view_activity')
selected_permissions.sort()
permissions = ','.join(selected_permissions) permissions = ','.join(selected_permissions)
invited_user = invite_api_client.create_invite( invited_user = invite_api_client.create_invite(
current_user.id, current_user.id,

3
app/notify_client/user_api_client.py
View File

@@ -99,7 +99,8 @@ class UserApiClient(BaseAPIClient):
def add_user_to_service(self, service_id, user_id, permissions): def add_user_to_service(self, service_id, user_id, permissions):
endpoint = '/service/{}/users/{}'.format(service_id, user_id) endpoint = '/service/{}/users/{}'.format(service_id, user_id)
resp = self.post(endpoint, data={'permissions': permissions}) data = [{'permission': x} for x in permissions]
resp = self.post(endpoint, data=data)
return User(resp['data'], max_failed_login_count=self.max_failed_login_count) return User(resp['data'], max_failed_login_count=self.max_failed_login_count)
def set_user_permissions(self, user_id, service_id, permissions): def set_user_permissions(self, user_id, service_id, permissions):

6
tests/app/main/views/test_manage_users.py
View File

@@ -160,11 +160,13 @@ def test_invite_user(
assert page.h1.string.strip() == 'Team members' assert page.h1.string.strip() == 'Team members'
flash_banner = page.find('div', class_='banner-default-with-tick').string.strip() flash_banner = page.find('div', class_='banner-default-with-tick').string.strip()
assert flash_banner == 'Invite sent to test@example.gov.uk' assert flash_banner == 'Invite sent to test@example.gov.uk'
excpected_permissions = 'manage_api_keys,manage_service,send_messages,view_activity'
expected_permissions = 'manage_api_keys,manage_settings,manage_templates,manage_users,send_emails,send_letters,send_texts,view_activity' # noqa
app.invite_api_client.create_invite.assert_called_once_with(sample_invite['from_user'], app.invite_api_client.create_invite.assert_called_once_with(sample_invite['from_user'],
sample_invite['service'], sample_invite['service'],
email_address, email_address,
excpected_permissions) expected_permissions)
def test_cancel_invited_user_cancels_user_invitations(app_, def test_cancel_invited_user_cancels_user_invitations(app_,