Merge pull request #998 from alphagov/invite-nongov-users

Invite nongov users

app/main/forms.py

@@ -21,7 +21,7 @@ from wtforms import (
 from wtforms.fields.html5 import EmailField, TelField
 from wtforms.validators import (DataRequired, Email, Length, Regexp, Optional)
 
-from app.main.validators import (Blacklist, CsvFileValidator, ValidEmailDomainRegex, NoCommasInPlaceHolders)
+from app.main.validators import (Blacklist, CsvFileValidator, ValidGovEmail, NoCommasInPlaceHolders)
 
 
 def get_time_value_and_label(future_time):
@@ -48,12 +48,16 @@ def get_next_hours_from(now, hours=23):
     ]
 
 
-def email_address(label='Email address'):
-    return EmailField(label, validators=[
+def email_address(label='Email address', gov_user=True):
+    validators = [
         Length(min=5, max=255),
         DataRequired(message='Can’t be empty'),
-        Email(message='Enter a valid email address'),
-        ValidEmailDomainRegex()])
+        Email(message='Enter a valid email address')
+    ]
+
+    if gov_user:
+        validators.append(ValidGovEmail())
+    return EmailField(label, validators)
 
 
 class UKMobileNumber(TelField):
@@ -126,7 +130,7 @@ class PermissionsForm(Form):
 
 
 class InviteUserForm(PermissionsForm):
-    email_address = email_address('Email address')
+    email_address = email_address(gov_user=False)
 
     def __init__(self, invalid_email_address, *args, **kwargs):
         super(InviteUserForm, self).__init__(*args, **kwargs)
@@ -242,7 +246,7 @@ class EmailTemplateForm(SMSTemplateForm):
 
 
 class ForgotPasswordForm(Form):
-    email_address = email_address()
+    email_address = email_address(gov_user=False)
 
 
 class NewPasswordForm(Form):

app/main/validators.py

@@ -1,7 +1,9 @@
-import re
 from wtforms import ValidationError
 from notifications_utils.template import Template
-from app.utils import Spreadsheet
+from app.utils import (
+    Spreadsheet,
+    is_gov_user
+)
 from ._blacklisted_passwords import blacklisted_passwords
 
 
@@ -26,17 +28,15 @@ class CsvFileValidator(object):
             raise ValidationError("{} isn’t a spreadsheet that Notify can read".format(field.data.filename))
 
 
-class ValidEmailDomainRegex(object):
+class ValidGovEmail(object):
 
     def __call__(self, form, field):
-        from flask import (current_app, url_for)
+        from flask import url_for
         message = (
             'Enter a central government email address.'
             ' If you think you should have access'
             ' <a href="{}">contact us</a>').format(url_for('main.feedback'))
-        valid_domains = current_app.config.get('EMAIL_DOMAIN_REGEXES', [])
-        email_regex = "[^\@^\s]+@([^@^\\.^\\s]+\.)*({})$".format("|".join(valid_domains))
-        if not re.match(email_regex, field.data.lower()):
+        if not is_gov_user(field.data.lower()):
             raise ValidationError(message)
 
 

app/main/views/add_service.py

@@ -3,9 +3,15 @@ from flask import (
     redirect,
     session,
     url_for,
-    current_app)
+    current_app
+)
 
-from flask_login import login_required
+from flask_login import (
+    current_user,
+    login_required
+)
+
+from werkzeug.exceptions import abort
 
 from app.main import main
 from app.main.forms import AddServiceForm
@@ -16,7 +22,32 @@ from app import (
     user_api_client,
     service_api_client
 )
-from app.utils import email_safe
+
+from app.utils import (
+    email_safe,
+    is_gov_user
+)
+
+
+def _add_invited_user_to_service(invited_user):
+    invitation = InvitedUser(**invited_user)
+    # if invited user add to service and redirect to dashboard
+    user = user_api_client.get_user(session['user_id'])
+    service_id = invited_user['service']
+    user_api_client.add_user_to_service(service_id, user.id, invitation.permissions)
+    invite_api_client.accept_invite(service_id, invitation.id)
+    return service_id
+
+
+def _create_service(service_name, email_from):
+    service_id = service_api_client.create_service(service_name=service_name,
+                                                   active=False,
+                                                   message_limit=current_app.config['DEFAULT_SERVICE_LIMIT'],
+                                                   restricted=True,
+                                                   user_id=session['user_id'],
+                                                   email_from=email_from)
+    session['service_id'] = service_id
+    return service_id
 
 
 @main.route("/add-service", methods=['GET', 'POST'])
@@ -24,25 +55,19 @@ from app.utils import email_safe
 def add_service():
     invited_user = session.get('invited_user')
     if invited_user:
-        invitation = InvitedUser(**invited_user)
-        # if invited user add to service and redirect to dashboard
-        user = user_api_client.get_user(session['user_id'])
-        service_id = invited_user['service']
-        user_api_client.add_user_to_service(service_id, user.id, invitation.permissions)
-        invite_api_client.accept_invite(service_id, invitation.id)
+        service_id = _add_invited_user_to_service(invited_user)
         return redirect(url_for('main.service_dashboard', service_id=service_id))
 
+    if not is_gov_user(current_user.email_address):
+        abort(403)
+
     form = AddServiceForm(service_api_client.find_all_service_email_from)
     heading = 'Which service do you want to set up notifications for?'
+
     if form.validate_on_submit():
         email_from = email_safe(form.name.data)
-        service_id = service_api_client.create_service(service_name=form.name.data,
-                                                       active=False,
-                                                       message_limit=current_app.config['DEFAULT_SERVICE_LIMIT'],
-                                                       restricted=True,
-                                                       user_id=session['user_id'],
-                                                       email_from=email_from)
-        session['service_id'] = service_id
+        service_name = form.name.data
+        service_id = _create_service(service_name, email_from)
 
         if (len(service_api_client.get_services({'user_id': session['user_id']}).get('data', [])) > 1):
             return redirect(url_for('main.service_dashboard', service_id=service_id))

app/main/views/choose_service.py

@@ -3,6 +3,7 @@ from flask_login import login_required, current_user
 from app.main import main
 from app import service_api_client
 from app.notify_client.service_api_client import ServicesBrowsableItem
+from app.utils import is_gov_user
 
 
 @main.route("/services")
@@ -11,7 +12,8 @@ def choose_service():
     return render_template(
         'views/choose-service.html',
         services=[ServicesBrowsableItem(x) for x in
-                  service_api_client.get_services({'user_id': current_user.id})['data']]
+                  service_api_client.get_services({'user_id': current_user.id})['data']],
+        can_add_service=is_gov_user(current_user.email_address)
     )
 
 

app/main/views/user_profile.py

@@ -1,6 +1,7 @@
 import json
 
 from flask import (
+    abort,
     render_template,
     redirect,
     url_for,
@@ -21,6 +22,8 @@ from app.main.forms import (
     ConfirmPasswordForm
 )
 
+from app.utils import is_gov_user
+
 from app import user_api_client
 
 NEW_EMAIL = 'new-email'
@@ -31,7 +34,10 @@ NEW_MOBILE_PASSWORD_CONFIRMED = 'new-mob-password-confirmed'
 @main.route("/user-profile")
 @login_required
 def user_profile():
-    return render_template('views/user-profile.html')
+    return render_template(
+        'views/user-profile.html',
+        can_see_edit=is_gov_user(current_user.email_address)
+    )
 
 
 @main.route("/user-profile/name", methods=['GET', 'POST'])
@@ -56,6 +62,9 @@ def user_profile_name():
 @login_required
 def user_profile_email():
 
+    if not is_gov_user(current_user.email_address):
+        abort(403)
+
     def _is_email_unique(email):
         return user_api_client.is_email_unique(email)
     form = ChangeEmailForm(_is_email_unique,

app/templates/views/choose-service.html

@@ -12,12 +12,14 @@
   </h1>
 
   {{ browse_list(services) }}
-  {{ browse_list([
-    {
-      'title': 'Add a new service…',
-      'link': url_for('.add_service')
-    },
-  ]) }}
+  {% if can_add_service %}
+    {{ browse_list([
+      {
+        'title': 'Add a new service…',
+        'link': url_for('.add_service')
+      },
+    ]) }}
+  {% endif %}
 
 
 {% endblock %}

app/templates/views/invite-user.html

@@ -16,7 +16,7 @@ Manage users – GOV.UK Notify
   <div class="grid-row">
     <form method="post" class="column-three-quarters">
 
-      {{ textbox(form.email_address, hint='Must be from a central government organisation', width='1-1', safe_error_message=True) }}
+      {{ textbox(form.email_address, width='1-1', safe_error_message=True) }}
 
       {% include 'views/manage-users/permissions.html' %}
 

app/templates/views/user-profile.html

@@ -28,7 +28,13 @@
       {{ item.value }}
     {% endcall %}
     {% call field(align='right') %}
-      <a href="{{ item.url }}">Change</a>
+      {% if item.label == 'Email address' %}
+        {% if can_see_edit %}
+          <a href="{{ item.url }}">Change</a>
+        {% endif %}
+      {% else %}
+          <a href="{{ item.url }}">Change</a>
+      {% endif %}
     {% endcall %}
   {% endcall %}
 

app/utils.py

@@ -3,7 +3,8 @@ import csv
 from io import StringIO
 from os import path
 from functools import wraps
-from flask import (abort, session, request, redirect, url_for)
+from flask import (abort, current_app, session, request, redirect, url_for)
+from flask_login import current_user
 import pyexcel
 import pyexcel.ext.io
 import pyexcel.ext.xls
@@ -41,7 +42,6 @@ def user_has_permissions(*permissions, admin_override=False, any_=False):
     def wrap(func):
         @wraps(func)
         def wrap_func(*args, **kwargs):
-            from flask_login import current_user
             if current_user and current_user.is_authenticated:
                 if current_user.has_permissions(
                     permissions=permissions,
@@ -198,3 +198,9 @@ class Spreadsheet():
 
 def get_help_argument():
     return request.args.get('help') if request.args.get('help') in ('1', '2', '3') else None
+
+
+def is_gov_user(email_address):
+    valid_domains = current_app.config['EMAIL_DOMAIN_REGEXES']
+    email_regex = (r"[\.|@]({})$".format("|".join(valid_domains)))
+    return bool(re.search(email_regex, email_address.lower()))