Let users with empty permissions see certain pages

We’re going to make it possible for some users to be members of a
service, but not have any permissions (not even `view_activity`).

There are some pages that these users should still be able to see
These are the pages that a user with ‘basic view’ would have been able
to see, excluding those that let them send messages.

app/main/views/dashboard.py

@@ -59,7 +59,7 @@ def old_service_dashboard(service_id):
 
 @main.route("/services/<service_id>")
 @login_required
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def service_dashboard(service_id):
 
     if session.get('invited_user'):

app/main/views/jobs.py

@@ -39,7 +39,7 @@ from app.utils import (
 
 @main.route("/services/<service_id>/jobs")
 @login_required
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def view_jobs(service_id):
     page = int(request.args.get('page', 1))
     jobs_response = job_api_client.get_page_of_jobs(service_id, page=page)
@@ -74,7 +74,7 @@ def view_jobs(service_id):
 
 @main.route("/services/<service_id>/jobs/<job_id>")
 @login_required
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def view_job(service_id, job_id):
     job = job_api_client.get_job(service_id, job_id)['data']
     if job['job_status'] == 'cancelled':
@@ -156,7 +156,7 @@ def cancel_job(service_id, job_id):
 
 
 @main.route("/services/<service_id>/jobs/<job_id>.json")
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def view_job_updates(service_id, job_id):
 
     job = job_api_client.get_job(service_id, job_id)['data']
@@ -174,7 +174,7 @@ def view_job_updates(service_id, job_id):
 @main.route('/services/<service_id>/notifications', methods=['GET', 'POST'])
 @main.route('/services/<service_id>/notifications/<message_type>', methods=['GET', 'POST'])
 @login_required
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def view_notifications(service_id, message_type=None):
     return render_template(
         'views/notifications.html',
@@ -198,7 +198,7 @@ def view_notifications(service_id, message_type=None):
 
 @main.route('/services/<service_id>/notifications.json', methods=['GET', 'POST'])
 @main.route('/services/<service_id>/notifications/<message_type>.json', methods=['GET', 'POST'])
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def get_notifications_as_json(service_id, message_type=None):
     return jsonify(get_notifications(
         service_id, message_type, status_override=request.args.get('status')
@@ -206,7 +206,7 @@ def get_notifications_as_json(service_id, message_type=None):
 
 
 @main.route('/services/<service_id>/notifications/<message_type>.csv', endpoint="view_notifications_csv")
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def get_notifications(service_id, message_type, status_override=None):
     # TODO get the api to return count of pages as well.
     page = get_page_from_request()

app/main/views/manage_users.py

@@ -24,7 +24,7 @@ from app.utils import user_has_permissions
 
 @main.route("/services/<service_id>/users")
 @login_required
-@user_has_permissions('view_activity')
+@user_has_permissions()
 def manage_users(service_id):
     users = sorted(
         user_api_client.get_users_for_service(service_id=service_id) + [

app/main/views/templates.py

@@ -46,7 +46,7 @@ page_headings = {
 
 @main.route("/services/<service_id>/templates/<uuid:template_id>")
 @login_required
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def view_template(service_id, template_id):
     if (
         current_user.has_permissions('send_messages') and
@@ -106,7 +106,7 @@ def start_tour(service_id, template_id):
 @main.route("/services/<service_id>/templates")
 @main.route("/services/<service_id>/templates/<template_type>")
 @login_required
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def choose_template(service_id, template_type='all'):
     templates = service_api_client.get_service_templates(service_id)['data']
 
@@ -161,7 +161,7 @@ def choose_template(service_id, template_type='all'):
 
 @main.route("/services/<service_id>/templates/<template_id>.<filetype>")
 @login_required
-@user_has_permissions('view_activity', 'send_messages')
+@user_has_permissions()
 def view_letter_template_preview(service_id, template_id, filetype):
     if filetype not in ('pdf', 'png'):
         abort(404)
@@ -188,7 +188,7 @@ def _view_template_version(service_id, template_id, version, letters_as_pdf=Fals
 
 @main.route("/services/<service_id>/templates/<template_id>/version/<int:version>")
 @login_required
-@user_has_permissions('view_activity')
+@user_has_permissions()
 def view_template_version(service_id, template_id, version):
     return render_template(
         'views/templates/template_history.html',
@@ -198,7 +198,7 @@ def view_template_version(service_id, template_id, version):
 
 @main.route("/services/<service_id>/templates/<template_id>/version/<int:version>.<filetype>")
 @login_required
-@user_has_permissions('view_activity')
+@user_has_permissions()
 def view_template_version_preview(service_id, template_id, version, filetype):
     db_template = service_api_client.get_service_template(service_id, template_id, version=version)['data']
     return TemplatePreview.from_database_object(db_template, filetype)

app/notify_client/models.py

@@ -124,7 +124,10 @@ class User(UserMixin):
         org_id = _get_org_id_from_view_args()
 
         if self.previewing_basic_view:
-            return self._permissions.get(service_id) and 'send_messages' in permissions
+            return self._permissions.get(service_id) and (
+                'send_messages' in permissions or
+                permissions == ()
+            )
 
         if not service_id and not org_id:
             # we shouldn't have any pages that require permissions, but don't specify a service or organisation.
@@ -137,7 +140,9 @@ class User(UserMixin):
 
         if org_id:
             return org_id in self.organisations
-        elif service_id:
+        if not permissions:
+            return service_id in self._permissions
+        if service_id:
             return any(x in self._permissions.get(service_id, []) for x in permissions)
 
     def has_permission_for_service(self, service_id, permission):

tests/app/main/views/test_send.py

@@ -2216,13 +2216,13 @@ def test_route_permissions_send_check_notifications(
     )
 
 
-@pytest.mark.parametrize('route', [
-    'main.choose_template',
-    'main.send_messages',
-    'main.get_example_csv',
-    'main.send_test'
+@pytest.mark.parametrize('route, expected_status', [
+    ('main.choose_template', 200),
+    ('main.send_messages', 403),
+    ('main.get_example_csv', 403),
+    ('main.send_test', 403),
 ])
-def test_route_invalid_permissions(
+def test_route_permissions_sending(
     mocker,
     app_,
     client,
@@ -2235,12 +2235,13 @@ def test_route_invalid_permissions(
     mock_create_job,
     fake_uuid,
     route,
+    expected_status,
 ):
     validate_route_permission(
         mocker,
         app_,
         "GET",
-        403,
+        expected_status,
         url_for(
             route,
             service_id=service_one['id'],