mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-08-23 07:46:23 -04:00
allow users to see letters even if they dont have edit permissions
same way as we handle seeing emails/sms
This commit is contained in:
@@ -8,7 +8,6 @@ from app.utils import user_has_permissions
|
|||||||
|
|
||||||
@main.route("/services/<service_id>/letters")
|
@main.route("/services/<service_id>/letters")
|
||||||
@login_required
|
@login_required
|
||||||
@user_has_permissions('manage_templates', 'send_letters', admin_override=True, any_=True)
|
|
||||||
def letters(service_id):
|
def letters(service_id):
|
||||||
if not current_service['can_send_letters']:
|
if not current_service['can_send_letters']:
|
||||||
abort(403)
|
abort(403)
|
||||||
|
|||||||
@@ -17,30 +17,7 @@ def test_letters_access_restricted(logged_in_client, mocker, can_send_letters, r
|
|||||||
assert response.status_code == response_code
|
assert response.status_code == response_code
|
||||||
|
|
||||||
|
|
||||||
@pytest.mark.parametrize('permission', [
|
def test_letters_lets_in_without_permission(
|
||||||
'send_letters',
|
|
||||||
'manage_templates'
|
|
||||||
])
|
|
||||||
def test_letters_lets_in_with_permissions(
|
|
||||||
client,
|
|
||||||
mocker,
|
|
||||||
mock_login,
|
|
||||||
mock_has_permissions,
|
|
||||||
api_user_active,
|
|
||||||
permission,
|
|
||||||
):
|
|
||||||
service = service_json(can_send_letters=True)
|
|
||||||
mocker.patch('app.service_api_client.get_service', return_value={"data": service})
|
|
||||||
|
|
||||||
api_user_active._permissions[str(service['id'])] = [permission]
|
|
||||||
|
|
||||||
client.login(api_user_active)
|
|
||||||
response = client.get(url_for('main.letters', service_id=service['id']))
|
|
||||||
|
|
||||||
assert response.status_code == 200
|
|
||||||
|
|
||||||
|
|
||||||
def test_letters_rejects_without_permissions(
|
|
||||||
client,
|
client,
|
||||||
mocker,
|
mocker,
|
||||||
mock_login,
|
mock_login,
|
||||||
@@ -53,4 +30,5 @@ def test_letters_rejects_without_permissions(
|
|||||||
client.login(api_user_active)
|
client.login(api_user_active)
|
||||||
response = client.get(url_for('main.letters', service_id=service['id']))
|
response = client.get(url_for('main.letters', service_id=service['id']))
|
||||||
|
|
||||||
|
assert api_user_active.permissions == {}
|
||||||
assert response.status_code == 200
|
assert response.status_code == 200
|
||||||
|
|||||||
@@ -24,3 +24,21 @@ def test_cant_see_letters_if_not_allowed(logged_in_client, mocker):
|
|||||||
assert response.status_code == 200
|
assert response.status_code == 200
|
||||||
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
|
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
|
||||||
assert 'Letter templates' not in page.find('nav', class_='navigation').text
|
assert 'Letter templates' not in page.find('nav', class_='navigation').text
|
||||||
|
|
||||||
|
|
||||||
|
def test_can_see_letters_without_permissions(
|
||||||
|
client,
|
||||||
|
mocker,
|
||||||
|
mock_login,
|
||||||
|
mock_has_permissions,
|
||||||
|
api_user_active
|
||||||
|
):
|
||||||
|
service = service_json(can_send_letters=True)
|
||||||
|
mocker.patch('app.service_api_client.get_service', return_value={"data": service})
|
||||||
|
|
||||||
|
client.login(api_user_active)
|
||||||
|
response = client.get(url_for('main.service_settings', service_id=service['id']))
|
||||||
|
|
||||||
|
assert response.status_code == 200
|
||||||
|
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
|
||||||
|
assert 'Letter templates' in page.find('nav', class_='navigation').text
|
||||||
|
|||||||
Reference in New Issue
Block a user