Merge pull request #3966 from alphagov/block-plus-addressing

Be strict about similar email addresses when inviting a user to an emergency alerts service

app/main/forms.py

@@ -62,6 +62,7 @@ from app.models.roles_and_permissions import (
     roles,
 )
 from app.utils import merge_jsonlike
+from app.utils.user import distinct_email_addresses
 
 
 def get_time_value_and_label(future_time):
@@ -1042,12 +1043,14 @@ class BroadcastPermissionsForm(BasePermissionsForm):
 class BaseInviteUserForm():
     email_address = email_address(gov_user=False)
 
-    def __init__(self, invalid_email_address, *args, **kwargs):
+    def __init__(self, inviter_email_address, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        self.invalid_email_address = invalid_email_address.lower()
+        self.inviter_email_address = inviter_email_address
 
     def validate_email_address(self, field):
-        if field.data.lower() == self.invalid_email_address and not current_user.platform_admin:
+        if current_user.platform_admin:
+            return
+        if field.data.lower() == self.inviter_email_address.lower():
             raise ValidationError("You cannot send an invitation to yourself")
 
 
@@ -1058,16 +1061,20 @@ class InviteUserForm(BaseInviteUserForm, PermissionsForm):
 class BroadcastInviteUserForm(BaseInviteUserForm, BroadcastPermissionsForm):
     email_address = email_address(gov_user=True)
 
+    def validate_email_address(self, field):
+        if not distinct_email_addresses(field.data, self.inviter_email_address):
+            raise ValidationError("You cannot send an invitation to yourself")
+
 
 class InviteOrgUserForm(StripWhitespaceForm):
     email_address = email_address(gov_user=False)
 
-    def __init__(self, invalid_email_address, *args, **kwargs):
+    def __init__(self, inviter_email_address, *args, **kwargs):
         super(InviteOrgUserForm, self).__init__(*args, **kwargs)
-        self.invalid_email_address = invalid_email_address.lower()
+        self.inviter_email_address = inviter_email_address.lower()
 
     def validate_email_address(self, field):
-        if field.data.lower() == self.invalid_email_address and not current_user.platform_admin:
+        if field.data.lower() == self.inviter_email_address and not current_user.platform_admin:
             raise ValidationError("You cannot send an invitation to yourself")
 
 

app/main/views/manage_users.py

@@ -59,7 +59,7 @@ def invite_user(service_id, user_id=None):
         form_class = InviteUserForm
 
     form = form_class(
-        invalid_email_address=current_user.email_address,
+        inviter_email_address=current_user.email_address,
         all_template_folders=current_service.all_template_folders,
         folder_permissions=[f['id'] for f in current_service.all_template_folders]
     )

app/main/views/organisations.py

@@ -184,7 +184,7 @@ def manage_org_users(org_id):
 @user_has_permissions()
 def invite_org_user(org_id):
     form = InviteOrgUserForm(
-        invalid_email_address=current_user.email_address
+        inviter_email_address=current_user.email_address
     )
     if form.validate_on_submit():
         email_address = form.email_address.data