From a1c4600b29068dd0791443b92ceb04a79b8eb51c Mon Sep 17 00:00:00 2001
From: Nicholas Staples <nicholas.staples@solution-tribute.com>
Date: Tue, 8 Mar 2016 16:54:07 +0000
Subject: [PATCH] Exact permissions added.

---
 app/notify_client/models.py  |  2 +-
 tests/app/main/test_utils.py | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/app/notify_client/models.py b/app/notify_client/models.py
index eacd0decb..9c8093ff4 100644
--- a/app/notify_client/models.py
+++ b/app/notify_client/models.py
@@ -88,7 +88,7 @@ class User(UserMixin):
         if service_id in self._permissions:
             if or_:
                 return any([x in self._permissions[service_id] for x in permissions])
-            return set(self._permissions[service_id]) > set(permissions)
+            return set(self._permissions[service_id]) >= set(permissions)
         return False
 
     @property
diff --git a/tests/app/main/test_utils.py b/tests/app/main/test_utils.py
index 6ab9b555f..3356ad7ef 100644
--- a/tests/app/main/test_utils.py
+++ b/tests/app/main/test_utils.py
@@ -58,6 +58,18 @@ def test_user_has_permissions_multiple(app_,
             response = decorated_index()
 
 
+def test_exact_permissions(app_,
+                           api_user_active,
+                           mock_login,
+                           mock_get_user_with_permissions):
+    with app_.test_request_context():
+        with app_.test_client() as client:
+            client.login(api_user_active)
+            decorator = user_has_permissions('manage_users', 'manage_templates', 'manage_settings')
+            decorated_index = decorator(index)
+            response = decorated_index()
+
+
 def test_validate_header_row():
     row = {'bad': '+44 7700 900981'}
     try: