Updated form and fixed existing tests.

app/main/dao/users_dao.py

@@ -9,6 +9,10 @@ from app.main.encryption import hashpw
 from app import user_api_client
 
 
+# TODO fix up this, do we really need this class why not just use the clients
+# directly??
+
+
 @login_manager.user_loader
 def load_user(user_id):
     return get_user_by_id(user_id)

app/main/forms.py

@@ -110,6 +110,10 @@ class RegisterUserFromInviteForm(Form):
 class InviteUserForm(Form):
     email_address = email_address('Their email address')
 
+    send_messages = BooleanField("Send messages")
+    manage_service = BooleanField("Manage service")
+    manage_api_keys = BooleanField("Manage API keys")
+
 
 class TwoFactorForm(Form):
     def __init__(self, validate_code_func, *args, **kwargs):

app/main/views/manage_users.py

@@ -15,9 +15,10 @@ from notifications_python_client.errors import HTTPError
 
 from app.main import main
 from app.main.forms import InviteUserForm
-from app.main.dao.services_dao import get_service_by_id_or_404
+from app.main.dao.services_dao import get_service_by_id
 from app import user_api_client
 from app import invite_api_client
+from app.utils import user_has_permissions
 
 fake_users = [
     {
@@ -32,45 +33,35 @@ fake_users = [
 
 @main.route("/services/<service_id>/users")
 @login_required
+@user_has_permissions('manage_users', 'manage_templates', 'manage_settings')
 def manage_users(service_id):
-    try:
-        users = user_api_client.get_users_for_service(service_id=service_id)
-        invited_users = invite_api_client.get_invites_for_service(service_id=service_id)
-        return render_template('views/manage-users.html',
-                               service_id=service_id,
-                               users=users,
-                               current_user=current_user,
-                               invited_users=invited_users)
-    except HTTPError as e:
-        if e.status_code == 404:
-            abort(404)
-        else:
-            raise e
+    users = user_api_client.get_users_for_service(service_id=service_id)
+    invited_users = invite_api_client.get_invites_for_service(service_id=service_id)
+    return render_template('views/manage-users.html',
+                           service_id=service_id,
+                           users=users,
+                           current_user=current_user,
+                           invited_users=invited_users)
 
 
 @main.route("/services/<service_id>/users/invite", methods=['GET', 'POST'])
 @login_required
+@user_has_permissions('manage_users', 'manage_templates', 'manage_settings')
 def invite_user(service_id):
 
+    service = get_service_by_id(service_id)
+
     form = InviteUserForm()
     if form.validate_on_submit():
         email_address = form.email_address.data
         permissions = _get_permissions(request.form)
-        try:
-            invited_user = invite_api_client.create_invite(current_user.id, service_id, email_address, permissions)
-            flash('Invite sent to {}'.format(invited_user.email_address), 'default_with_tick')
-            return redirect(url_for('.manage_users', service_id=service_id))
-
-        except HTTPError as e:
-            if e.status_code == 404:
-                abort(404)
-            else:
-                raise e
+        invited_user = invite_api_client.create_invite(current_user.id, service_id, email_address, permissions)
+        flash('Invite sent to {}'.format(invited_user.email_address), 'default_with_tick')
+        return redirect(url_for('.manage_users', service_id=service_id))
 
     return render_template(
         'views/invite-user.html',
-        user={},
-        service=get_service_by_id_or_404(service_id),
+        user=None,
         service_id=service_id,
         form=form
     )
@@ -78,29 +69,40 @@ def invite_user(service_id):
 
 @main.route("/services/<service_id>/users/<user_id>", methods=['GET', 'POST'])
 @login_required
+@user_has_permissions('manage_users', 'manage_templates', 'manage_settings')
 def edit_user_permissions(service_id, user_id):
+    # TODO we should probably using the service id here in the get user
+    # call as well. eg. /user/<user_id>?&service_id=service_id
+    user = user_api_client.get_user(user_id)
+    service = get_service_by_id(service_id)
 
-    if request.method == 'POST':
+    form = InviteUserForm(**{
+        'email_address': user.email_address,
+        'send_messages': user.has_permissions(['send_texts', 'send_emails', 'send_letters']),
+        'manage_service': user.has_permissions(['manage_users', 'manage_templates', 'manage_settings']),
+        'manage_api_keys': user.has_permissions(['manage_api_keys', 'access_developer_docs'])
+        })
+    if form.validate_on_submit():
         return redirect(url_for('.manage_users', service_id=service_id))
 
     return render_template(
         'views/invite-user.html',
-        user=fake_users[int(user_id)],
-        user_id=user_id,
-        service=get_service_by_id_or_404(service_id),
+        user=user,
+        form=form,
         service_id=service_id
     )
 
 
 @main.route("/services/<service_id>/users/<user_id>/delete", methods=['GET', 'POST'])
 @login_required
+@user_has_permissions('manage_users', 'manage_templates', 'manage_settings')
 def delete_user(service_id, user_id):
+    user = user_api_client.get_user(user_id)
+    service = get_service_by_id(service_id)
 
     if request.method == 'POST':
         return redirect(url_for('.manage_users', service_id=service_id))
 
-    user = fake_users[int(user_id)]
-
     flash(
         'Are you sure you want to delete {}’s account?'.format(user.get('name') or user['email_localpart']),
         'delete'
@@ -109,13 +111,12 @@ def delete_user(service_id, user_id):
     return render_template(
         'views/invite-user.html',
         user=user,
-        user_id=user_id,
-        service=get_service_by_id_or_404(service_id),
         service_id=service_id
     )
 
 
 @main.route("/services/<service_id>/cancel-invited-user/<invited_user_id>", methods=['GET'])
+@user_has_permissions('manage_users', 'manage_templates', 'manage_settings')
 def cancel_invited_user(service_id, invited_user_id):
     invite_api_client.cancel_invited_user(service_id=service_id, invited_user_id=invited_user_id)