From 9a70f6a7f4f4efde6cfd1b7dfec943fb9a4f73c2 Mon Sep 17 00:00:00 2001 From: Chris Hill-Scott Date: Wed, 12 Dec 2018 12:54:22 +0000 Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20let=20non-government=20users=20?= =?UTF-8?q?request=20to=20go=20live?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Only users who work for government can accept the terms of use. This will save us from having to email these requesters back telling them they need to find someone else to submit the request. --- app/main/views/service_settings.py | 4 ++ .../service-settings/request-to-go-live.html | 18 +++++--- tests/app/main/views/test_service_settings.py | 46 +++++++++++++++++++ tests/conftest.py | 36 +++++++++------ 4 files changed, 85 insertions(+), 19 deletions(-) diff --git a/app/main/views/service_settings.py b/app/main/views/service_settings.py index 965b516c6..73201f079 100644 --- a/app/main/views/service_settings.py +++ b/app/main/views/service_settings.py @@ -147,6 +147,10 @@ def request_to_go_live(service_id): @login_required @user_has_permissions('manage_service') def submit_request_to_go_live(service_id): + + if not current_user.is_gov_user: + abort(403) + form = RequestToGoLiveForm() if form.validate_on_submit(): diff --git a/app/templates/views/service-settings/request-to-go-live.html b/app/templates/views/service-settings/request-to-go-live.html index 73ebd685e..c6e66fa2e 100644 --- a/app/templates/views/service-settings/request-to-go-live.html +++ b/app/templates/views/service-settings/request-to-go-live.html @@ -47,12 +47,18 @@ ) }} {% endif %} {% endcall %} -

- You also need to accept our terms of use. -

-

- Continue -

+ {% if current_user.is_gov_user %} +

+ You also need to accept our terms of use. +

+

+ Continue +

+ {% else %} +

+ Only team members with a government email address can request to go live. +

+ {% endif %} {% endblock %} diff --git a/tests/app/main/views/test_service_settings.py b/tests/app/main/views/test_service_settings.py index 5ebb9cb93..56f8d6c2d 100644 --- a/tests/app/main/views/test_service_settings.py +++ b/tests/app/main/views/test_service_settings.py @@ -772,6 +772,38 @@ def test_should_check_for_mou_on_request_to_go_live( assert normalize_spaces(checklist_items[2].text) == expected_item +def test_non_gov_user_is_told_they_cant_go_live( + client_request, + api_nongov_user_active, + mocker, +): + mocker.patch( + 'app.main.views.service_settings.user_api_client.get_count_of_users_with_permission', + return_value=0, + ) + mocker.patch( + 'app.models.service.Service.all_templates', + new_callable=PropertyMock, + return_value=[], + ) + mocker.patch( + 'app.main.views.service_settings.service_api_client.get_sms_senders', + return_value=[], + ) + mocker.patch( + 'app.main.views.service_settings.service_api_client.get_reply_to_email_addresses', + return_value=[], + ) + client_request.login(api_nongov_user_active) + page = client_request.get( + 'main.request_to_go_live', service_id=SERVICE_ONE_ID + ) + assert normalize_spaces(page.select_one('main p').text) == ( + 'Only team members with a government email address can request to go live.' + ) + assert page.select('.button') == [] + + def test_should_show_request_to_go_live( client_request, ): @@ -798,6 +830,20 @@ def test_should_show_request_to_go_live( ) == label +@pytest.mark.parametrize('method', ('get', 'post')) +def test_non_gov_users_cant_request_to_go_live( + client_request, + api_nongov_user_active, + method, +): + client_request.login(api_nongov_user_active) + getattr(client_request, method)( + 'main.submit_request_to_go_live', + service_id=SERVICE_ONE_ID, + _expected_status=403, + ) + + @freeze_time("2012-12-21") def test_should_redirect_after_request_to_go_live( client_request, diff --git a/tests/conftest.py b/tests/conftest.py index 1adef71d2..282cd22f2 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -1135,19 +1135,29 @@ def api_user_active_email_auth(fake_uuid, email_address='test@user.gov.uk'): @pytest.fixture(scope='function') def api_nongov_user_active(fake_uuid): from app.notify_client.user_api_client import User - user_data = {'id': fake_uuid, - 'name': 'Test User', - 'password': 'somepassword', - 'email_address': 'someuser@notonwhitelist.com', - 'mobile_number': '07700 900762', - 'state': 'active', - 'failed_login_count': 0, - 'permissions': {}, - 'platform_admin': False, - 'auth_type': 'sms_auth', - 'password_changed_at': str(datetime.utcnow()), - 'organisations': [] - } + user_data = { + 'id': fake_uuid, + 'name': 'Test User', + 'password': 'somepassword', + 'email_address': 'someuser@notonwhitelist.com', + 'mobile_number': '07700 900762', + 'state': 'active', + 'failed_login_count': 0, + 'permissions': {SERVICE_ONE_ID: [ + 'send_texts', + 'send_emails', + 'send_letters', + 'manage_users', + 'manage_templates', + 'manage_settings', + 'manage_api_keys', + 'view_activity', + ]}, + 'platform_admin': False, + 'auth_type': 'sms_auth', + 'password_changed_at': str(datetime.utcnow()), + 'organisations': [] + } user = User(user_data) return user