Start to remove use of the term "roles"

We don't use this term consistently and it's not defined anywhere.
Since most of the Admin app deals with user-facing permssions, it's
OK to just use the term "permissions". Where both types of permission
are present in the same file, we can more clearly distinguish them
as "UI permissions" and "DB permissions".

app/main/forms.py

@@ -59,9 +59,9 @@ from app.models.organisation import Organisation
 from app.utils import merge_jsonlike
 from app.utils.user import distinct_email_addresses
 from app.utils.user_permissions import (
+    all_ui_permissions,
     broadcast_permission_options,
     permission_options,
-    roles,
 )
 
 
@@ -1006,7 +1006,7 @@ class BasePermissionsForm(StripWhitespaceForm):
             **kwargs,
             **{
                 "permissions_field": [
-                    role for role in roles.keys() if user.has_permission_for_service(service_id, role)]
+                    role for role in all_ui_permissions if user.has_permission_for_service(service_id, role)]
             },
             login_authentication=user.auth_type
         )

app/models/user.py

@@ -17,7 +17,7 @@ from app.notify_client.org_invite_api_client import org_invite_api_client
 from app.notify_client.user_api_client import user_api_client
 from app.utils.user import is_gov_user
 from app.utils.user_permissions import (
-    all_permissions,
+    all_ui_permissions,
     translate_permissions_from_db_to_admin_roles,
 )
 
@@ -201,7 +201,7 @@ class User(JSONModel, UserMixin):
         return self._platform_admin and not session.get('disable_platform_admin_view', False)
 
     def has_permissions(self, *permissions, restrict_admin_usage=False, allow_org_user=False):
-        unknown_permissions = set(permissions) - all_permissions
+        unknown_permissions = set(permissions) - all_ui_permissions
         if unknown_permissions:
             raise TypeError('{} are not valid permissions'.format(list(unknown_permissions)))
 

app/notify_client/invite_api_client.py

@@ -1,6 +1,6 @@
 from app.notify_client import NotifyAdminAPIClient, _attach_current_user, cache
 from app.utils.user_permissions import (
-    roles,
+    all_ui_permissions,
     translate_permissions_from_admin_roles_to_db,
 )
 
@@ -48,7 +48,7 @@ class InviteApiClient(NotifyAdminAPIClient):
         )['data']
 
     def get_count_of_invites_with_permission(self, service_id, permission):
-        if permission not in roles.keys():
+        if permission not in all_ui_permissions:
             raise TypeError('{} is not a valid permission'.format(permission))
         return len([
             invited_user for invited_user in self.get_invites_for_service(service_id)

app/utils/user_permissions.py

@@ -1,6 +1,6 @@
 from itertools import chain
 
-roles = {
+permission_mappings = {
     'send_messages': ['send_texts', 'send_emails', 'send_letters'],
     'manage_templates': ['manage_templates'],
     'manage_service': ['manage_users', 'manage_settings'],
@@ -10,8 +10,8 @@ roles = {
     'approve_broadcasts': ['approve_broadcasts', 'reject_broadcasts', 'cancel_broadcasts'],
 }
 
-all_permissions = set(roles.keys())
-all_database_permissions = set(chain(*roles.values()))
+all_ui_permissions = set(permission_mappings.keys())
+all_db_permissions = set(chain(*permission_mappings.values()))
 
 permission_options = (
     ('view_activity', 'See dashboard'),
@@ -35,10 +35,10 @@ def translate_permissions_from_db_to_admin_roles(permissions):
     A role is returned if all of its database permissions are in the permission list that is passed in.
     Any permissions in the list that are not database permissions are also returned.
     """
-    unknown_database_permissions = {p for p in permissions if p not in all_database_permissions}
+    unknown_database_permissions = {p for p in permissions if p not in all_db_permissions}
 
     return {
-        admin_role for admin_role, db_role_list in roles.items()
+        admin_role for admin_role, db_role_list in permission_mappings.items()
         if set(db_role_list) <= set(permissions)
     } | unknown_database_permissions
 
@@ -49,4 +49,4 @@ def translate_permissions_from_admin_roles_to_db(permissions):
 
     Looks them up in the roles dict, falling back to just passing through if they're not recognised.
     """
-    return set(chain.from_iterable(roles.get(permission, [permission]) for permission in permissions))
+    return set(chain.from_iterable(permission_mappings.get(permission, [permission]) for permission in permissions))