Set folder permissions when creating and accepting invites to services

Added a folder permissions form to the page to invite users to services.
This only shows if the service has 'edit_folder_permissions' enabled,
and all folder checkboxes are checked by default. This change means that
InviteApiClient.create_invite now sends folder_permissions through to
notifications_api (so invites get created with folder permissions).

Started passing the folder_permissions through to notifications-api when
accepting an invite. This changes UserApiClient.add_user_to_service to
send folder_permissions to notifications_api so that new users get folder
permissions when they are added to the service.

app/main/views/invites.py

@@ -70,7 +70,8 @@ def accept_invite(token):
                 user_api_client.update_user_attribute(existing_user.id, auth_type=invited_user.auth_type)
             user_api_client.add_user_to_service(invited_user.service,
                                                 existing_user.id,
-                                                invited_user.permissions)
+                                                invited_user.permissions,
+                                                invited_user.folder_permissions)
             return redirect(url_for('main.service_dashboard', service_id=invited_user.service))
     else:
         return redirect(url_for('main.register_from_invite'))

app/main/views/manage_users.py

@@ -47,7 +47,11 @@ def manage_users(service_id):
 @user_has_permissions('manage_service')
 def invite_user(service_id):
 
-    form = InviteUserForm(invalid_email_address=current_user.email_address)
+    form = InviteUserForm(
+        invalid_email_address=current_user.email_address,
+        all_template_folders=current_service.all_template_folders,
+        folder_permissions=[f['id'] for f in current_service.all_template_folders]
+    )
 
     service_has_email_auth = current_service.has_permission('email_auth')
     if not service_has_email_auth:
@@ -60,7 +64,11 @@ def invite_user(service_id):
             service_id,
             email_address,
             form.permissions,
-            form.login_authentication.data
+            form.login_authentication.data,
+            folder_permissions=(
+                form.folder_permissions.data
+                if current_service.has_permission('edit_folder_permissions') else []
+            ),
         )
 
         flash('Invite sent to {}'.format(invited_user.email_address), 'default_with_tick')

app/main/views/verify.py

@@ -94,5 +94,5 @@ def _add_invited_user_to_service(invited_user):
     invitation = InvitedUser(**invited_user)
     user = user_api_client.get_user(session['user_id'])
     service_id = invited_user['service']
-    user_api_client.add_user_to_service(service_id, user.id, invitation.permissions)
+    user_api_client.add_user_to_service(service_id, user.id, invitation.permissions, invitation.folder_permissions)
     return service_id

app/notify_client/invite_api_client.py

@@ -12,7 +12,13 @@ class InviteApiClient(NotifyAdminAPIClient):
 
         self.admin_url = app.config['ADMIN_BASE_URL']
 
-    def create_invite(self, invite_from_id, service_id, email_address, permissions, auth_type):
+    def create_invite(self,
+                      invite_from_id,
+                      service_id,
+                      email_address,
+                      permissions,
+                      auth_type,
+                      folder_permissions):
         data = {
             'service': str(service_id),
             'email_address': email_address,
@@ -20,6 +26,7 @@ class InviteApiClient(NotifyAdminAPIClient):
             'permissions': ','.join(sorted(translate_permissions_from_admin_roles_to_db(permissions))),
             'auth_type': auth_type,
             'invite_link_host': self.admin_url,
+            'folder_permissions': folder_permissions,
         }
         data = _attach_current_user(data)
         resp = self.post(url='/service/{}/invite'.format(service_id), data=data)

app/notify_client/user_api_client.py

@@ -150,11 +150,12 @@ class UserApiClient(NotifyAdminAPIClient):
 
     @cache.delete('service-{service_id}')
     @cache.delete('user-{user_id}')
-    def add_user_to_service(self, service_id, user_id, permissions):
+    def add_user_to_service(self, service_id, user_id, permissions, folder_permissions):
         # permissions passed in are the combined admin roles, not db permissions
         endpoint = '/service/{}/users/{}'.format(service_id, user_id)
         data = {
-            'permissions': [{'permission': x} for x in translate_permissions_from_admin_roles_to_db(permissions)]
+            'permissions': [{'permission': x} for x in translate_permissions_from_admin_roles_to_db(permissions)],
+            'folder_permissions': folder_permissions,
         }
 
         self.post(endpoint, data=data)