From 077a533d8160ce4a2fd345ea3e732401a0986ac7 Mon Sep 17 00:00:00 2001
From: Pea Tyczynska <pea.tyczynska@digital.cabinet-office.gov.uk>
Date: Thu, 14 Mar 2019 17:21:18 +0000
Subject: [PATCH 1/5] Subheader for edit users who can see a folder

---
 .../views/templates/manage-template-folder.html          | 3 +++
 tests/app/main/views/test_template_folders.py            | 9 ++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/app/templates/views/templates/manage-template-folder.html b/app/templates/views/templates/manage-template-folder.html
index 2b14dee9f..f2aa3748f 100644
--- a/app/templates/views/templates/manage-template-folder.html
+++ b/app/templates/views/templates/manage-template-folder.html
@@ -23,6 +23,9 @@
 
   {% call form_wrapper(action=url_for('main.manage_template_folder', service_id=current_service.id, template_folder_id=template_folder_id)) %}
     {{ textbox(form.name) }}
+    {% if current_service.has_permission("edit_folder_permissions") %}
+      <p id="users-with-permissions">Users who can see this folder:</p>
+    {% endif %}
     {{ page_footer(
       'Save',
       delete_link=url_for(
diff --git a/tests/app/main/views/test_template_folders.py b/tests/app/main/views/test_template_folders.py
index 00f22ef34..d59f20e6e 100644
--- a/tests/app/main/views/test_template_folders.py
+++ b/tests/app/main/views/test_template_folders.py
@@ -415,11 +415,15 @@ def test_can_create_email_template_with_parent_folder(
         data['parent_folder_id'])
 
 
+@pytest.mark.parametrize("folder_permissions, expected_len", [(['edit_folder_permissions'], 1), ([], 0)])
 def test_get_manage_folder_page(
     client_request,
     service_one,
     mock_get_template_folders,
+    folder_permissions,
+    expected_len
 ):
+    service_one["permissions"] += folder_permissions
     folder_id = str(uuid.uuid4())
     mock_get_template_folders.return_value = [
         {'id': folder_id, 'name': 'folder_two', 'parent_id': None},
@@ -437,9 +441,12 @@ def test_get_manage_folder_page(
     assert page.select_one('input[name=name]')['value'] == 'folder_two'
     delete_link = page.find('a', string="Delete this folder")
     expected_delete_url = "/services/{}/templates/folders/{}/delete".format(service_one['id'], folder_id)
-
     assert expected_delete_url in delete_link["href"]
 
+    assert len(page.select('p[id=users-with-permissions]')) == expected_len
+    if expected_len == 1:
+        assert page.select('p[id=users-with-permissions]')[0].text == "Users who can see this folder:"
+
 
 def test_manage_folder_page_404s(client_request, service_one, mock_get_template_folders):
     client_request.get(

From 1ab36dd026f6e6a7dc359a6c3f9d3163f638d05b Mon Sep 17 00:00:00 2001
From: Pea Tyczynska <pea.tyczynska@digital.cabinet-office.gov.uk>
Date: Fri, 15 Mar 2019 14:13:27 +0000
Subject: [PATCH 2/5] Show checkboxes for users with permission to view the
 managed folder

---
 app/main/forms.py                             |  9 +++++++
 app/main/views/templates.py                   | 10 +++++---
 .../templates/manage-template-folder.html     |  4 ++-
 tests/app/main/views/test_template_folders.py | 25 ++++++++++++++-----
 4 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/app/main/forms.py b/app/main/forms.py
index aa5c54ab8..4a1461b2c 100644
--- a/app/main/forms.py
+++ b/app/main/forms.py
@@ -1285,6 +1285,15 @@ class ReturnedLettersForm(StripWhitespaceForm):
 
 
 class TemplateFolderForm(StripWhitespaceForm):
+    def __init__(self, users_with_permission=None, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if users_with_permission is not None:
+            self.viewing_permissions.users_with_permission = users_with_permission
+            self.viewing_permissions.choices = [
+                (item.id, item.name) for item in users_with_permission
+            ]
+
+    viewing_permissions = MultiCheckboxField('Users who can see this folder:')
     name = StringField('Folder name', validators=[DataRequired(message='Can’t be empty')])
 
 
diff --git a/app/main/views/templates.py b/app/main/views/templates.py
index a16564748..fd3eab99a 100644
--- a/app/main/views/templates.py
+++ b/app/main/views/templates.py
@@ -430,9 +430,13 @@ def action_blocked(service_id, notification_type, return_to, template_id):
 @login_required
 @user_has_permissions('manage_templates')
 def manage_template_folder(service_id, template_folder_id):
-
+    current_folder = current_service.get_template_folder(template_folder_id)
+    users_with_folder_permission = [
+        current_service.get_team_member(user_id) for user_id in current_folder['users_with_permission']
+    ]
     form = TemplateFolderForm(
-        name=current_service.get_template_folder(template_folder_id)['name']
+        name=current_folder['name'],
+        users_with_permission=users_with_folder_permission
     )
 
     if form.validate_on_submit():
@@ -449,7 +453,7 @@ def manage_template_folder(service_id, template_folder_id):
         template_folder_path=current_service.get_template_folder_path(template_folder_id),
         current_service_id=current_service.id,
         template_folder_id=template_folder_id,
-        template_type="all"
+        template_type="all",
     )
 
 
diff --git a/app/templates/views/templates/manage-template-folder.html b/app/templates/views/templates/manage-template-folder.html
index f2aa3748f..9541e9106 100644
--- a/app/templates/views/templates/manage-template-folder.html
+++ b/app/templates/views/templates/manage-template-folder.html
@@ -1,6 +1,7 @@
 {% extends "withnav_template.html" %}
 {% from "components/folder-path.html" import folder_path, page_title_folder_path %}
 {% from "components/textbox.html" import textbox %}
+{% from "components/checkbox.html" import checkbox, checkbox_group %}
 {% from "components/page-footer.html" import page_footer %}
 {% from "components/form.html" import form_wrapper %}
 
@@ -24,8 +25,9 @@
   {% call form_wrapper(action=url_for('main.manage_template_folder', service_id=current_service.id, template_folder_id=template_folder_id)) %}
     {{ textbox(form.name) }}
     {% if current_service.has_permission("edit_folder_permissions") %}
-      <p id="users-with-permissions">Users who can see this folder:</p>
+      {{ checkbox_group("Users who can see this folder:", form.viewing_permissions) }}
     {% endif %}
+
     {{ page_footer(
       'Save',
       delete_link=url_for(
diff --git a/tests/app/main/views/test_template_folders.py b/tests/app/main/views/test_template_folders.py
index d59f20e6e..976b7b164 100644
--- a/tests/app/main/views/test_template_folders.py
+++ b/tests/app/main/views/test_template_folders.py
@@ -418,16 +418,21 @@ def test_can_create_email_template_with_parent_folder(
 @pytest.mark.parametrize("folder_permissions, expected_len", [(['edit_folder_permissions'], 1), ([], 0)])
 def test_get_manage_folder_page(
     client_request,
+    active_user_with_permissions,
     service_one,
     mock_get_template_folders,
+    mocker,
     folder_permissions,
-    expected_len
+    expected_len,
 ):
     service_one["permissions"] += folder_permissions
     folder_id = str(uuid.uuid4())
     mock_get_template_folders.return_value = [
-        {'id': folder_id, 'name': 'folder_two', 'parent_id': None},
+        {'id': folder_id, 'name': 'folder_two', 'parent_id': None, 'users_with_permission': [
+            active_user_with_permissions.id
+        ]},
     ]
+    mocker.patch('app.models.service.Service.get_team_member', return_value=active_user_with_permissions)
 
     page = client_request.get(
         'main.manage_template_folder',
@@ -443,9 +448,14 @@ def test_get_manage_folder_page(
     expected_delete_url = "/services/{}/templates/folders/{}/delete".format(service_one['id'], folder_id)
     assert expected_delete_url in delete_link["href"]
 
-    assert len(page.select('p[id=users-with-permissions]')) == expected_len
+    form_labels = page.select('legend[class=form-label]')
+    assert len(form_labels) == expected_len
     if expected_len == 1:
-        assert page.select('p[id=users-with-permissions]')[0].text == "Users who can see this folder:"
+        assert "Users who can see this folder:" in form_labels[0].text
+        checkboxes = page.select('input[name=viewing_permissions]')
+        assert len(checkboxes) == 1
+        assert checkboxes[0]['value'] == 'y'
+        assert "Test User" in page.findAll('label', {'for': 'viewing_permissions-0'})[0].text
 
 
 def test_manage_folder_page_404s(client_request, service_one, mock_get_template_folders):
@@ -470,12 +480,15 @@ def test_get_manage_folder_page_no_permissions(
     )
 
 
-def test_rename_folder(client_request, service_one, mock_get_template_folders, mocker):
+def test_rename_folder(client_request, active_user_with_permissions, service_one, mock_get_template_folders, mocker):
     mock_update = mocker.patch('app.template_folder_api_client.update_template_folder')
     folder_id = str(uuid.uuid4())
     mock_get_template_folders.return_value = [
-        {'id': folder_id, 'name': 'folder_two', 'parent_id': None},
+        {'id': folder_id, 'name': 'folder_two', 'parent_id': None, 'users_with_permission': [
+            active_user_with_permissions.id
+        ]}
     ]
+    mocker.patch('app.models.service.Service.get_team_member', return_value=active_user_with_permissions)
 
     client_request.post(
         'main.manage_template_folder',

From e85969f6fad360f55764b672132ceabfc6c678d2 Mon Sep 17 00:00:00 2001
From: Pea Tyczynska <pea.tyczynska@digital.cabinet-office.gov.uk>
Date: Fri, 15 Mar 2019 17:19:18 +0000
Subject: [PATCH 3/5] Change folder viewing permissions from manage folder page

---
 app/main/views/templates.py                   |  6 ++-
 .../template_folder_api_client.py             |  7 +++-
 app/templates/components/checkbox.html        | 16 +++++---
 .../templates/manage-template-folder.html     |  2 +-
 tests/app/main/views/test_template_folders.py | 38 +++++++++++++++++--
 .../test_template_folder_client.py            |  4 +-
 6 files changed, 57 insertions(+), 16 deletions(-)

diff --git a/app/main/views/templates.py b/app/main/views/templates.py
index fd3eab99a..5e4410a68 100644
--- a/app/main/views/templates.py
+++ b/app/main/views/templates.py
@@ -438,10 +438,12 @@ def manage_template_folder(service_id, template_folder_id):
         name=current_folder['name'],
         users_with_permission=users_with_folder_permission
     )
-
     if form.validate_on_submit():
         template_folder_api_client.update_template_folder(
-            current_service.id, template_folder_id, name=form.name.data
+            current_service.id,
+            template_folder_id,
+            name=form.name.data,
+            users_with_permission=form.viewing_permissions.data
         )
         return redirect(
             url_for('.choose_template', service_id=service_id, template_folder_id=template_folder_id)
diff --git a/app/notify_client/template_folder_api_client.py b/app/notify_client/template_folder_api_client.py
index d273b4dc8..f7015c1cb 100644
--- a/app/notify_client/template_folder_api_client.py
+++ b/app/notify_client/template_folder_api_client.py
@@ -42,10 +42,13 @@ class TemplateFolderAPIClient(NotifyAdminAPIClient):
             ))
 
     @cache.delete('service-{service_id}-template-folders')
-    def update_template_folder(self, service_id, template_folder_id, name):
+    def update_template_folder(self, service_id, template_folder_id, name, users_with_permission=None):
+        data = {"name": name}
+        if users_with_permission:
+            data["users_with_permission"] = users_with_permission
         self.post(
             '/service/{}/template-folder/{}'.format(service_id, template_folder_id),
-            {"name": name}
+            data
         )
 
     @cache.delete('service-{service_id}-template-folders')
diff --git a/app/templates/components/checkbox.html b/app/templates/components/checkbox.html
index 0a9e0907b..8adba1556 100644
--- a/app/templates/components/checkbox.html
+++ b/app/templates/components/checkbox.html
@@ -3,10 +3,11 @@
 {% macro checkbox(
   field,
   hint=False,
-  width='2-3'
+  width='2-3',
+  value='y'
 ) %}
   <div class="multiple-choice">
-    {{ checkbox_input(field.id, field.name, field.data) }}
+    {{ checkbox_input(field.id, field.name, field.data, value) }}
     <label for="{{ field.id }}">
       {{ field.label.text }}
       {% if hint %}
@@ -42,14 +43,17 @@
 
 {% macro checkbox_group(
   legend,
-  fields
+  fields,
+  set_value=False
 ) %}
   <fieldset class="form-group">
     <legend class="form-label">
       {{ legend }}
     </legend>
-    {% for field in fields %}
-      {{ checkbox(field) }}
-    {% endfor %}
+    {% if set_value %}
+      {% for field in fields %}
+        {{ checkbox(field, value=field.data) }}
+      {% endfor %}
+    {% endif %}
   </fieldset>
 {% endmacro %}
diff --git a/app/templates/views/templates/manage-template-folder.html b/app/templates/views/templates/manage-template-folder.html
index 9541e9106..540609792 100644
--- a/app/templates/views/templates/manage-template-folder.html
+++ b/app/templates/views/templates/manage-template-folder.html
@@ -25,7 +25,7 @@
   {% call form_wrapper(action=url_for('main.manage_template_folder', service_id=current_service.id, template_folder_id=template_folder_id)) %}
     {{ textbox(form.name) }}
     {% if current_service.has_permission("edit_folder_permissions") %}
-      {{ checkbox_group("Users who can see this folder:", form.viewing_permissions) }}
+      {{ checkbox_group("Users who can see this folder:", form.viewing_permissions, set_value=True) }}
     {% endif %}
 
     {{ page_footer(
diff --git a/tests/app/main/views/test_template_folders.py b/tests/app/main/views/test_template_folders.py
index 976b7b164..c1ba415c4 100644
--- a/tests/app/main/views/test_template_folders.py
+++ b/tests/app/main/views/test_template_folders.py
@@ -454,7 +454,7 @@ def test_get_manage_folder_page(
         assert "Users who can see this folder:" in form_labels[0].text
         checkboxes = page.select('input[name=viewing_permissions]')
         assert len(checkboxes) == 1
-        assert checkboxes[0]['value'] == 'y'
+        assert checkboxes[0]['value'] == active_user_with_permissions.id
         assert "Test User" in page.findAll('label', {'for': 'viewing_permissions-0'})[0].text
 
 
@@ -494,7 +494,7 @@ def test_rename_folder(client_request, active_user_with_permissions, service_one
         'main.manage_template_folder',
         service_id=service_one['id'],
         template_folder_id=folder_id,
-        _data={"name": "new beautiful name"},
+        _data={"name": "new beautiful name", "viewing_permissions": [active_user_with_permissions.id]},
         _expected_redirect=url_for("main.choose_template",
                                    service_id=service_one['id'],
                                    template_folder_id=folder_id,
@@ -504,7 +504,39 @@ def test_rename_folder(client_request, active_user_with_permissions, service_one
     mock_update.assert_called_once_with(
         service_one['id'],
         folder_id,
-        name="new beautiful name"
+        name="new beautiful name",
+        users_with_permission=[active_user_with_permissions.id]
+    )
+
+
+def test_manage_folder_users(
+    client_request, active_user_with_permissions, service_one, mock_get_template_folders, mocker
+):
+    mock_update = mocker.patch('app.template_folder_api_client.update_template_folder')
+    folder_id = str(uuid.uuid4())
+    mock_get_template_folders.return_value = [
+        {'id': folder_id, 'name': 'folder_two', 'parent_id': None, 'users_with_permission': [
+            active_user_with_permissions.id
+        ]}
+    ]
+    mocker.patch('app.models.service.Service.get_team_member', return_value=active_user_with_permissions)
+
+    client_request.post(
+        'main.manage_template_folder',
+        service_id=service_one['id'],
+        template_folder_id=folder_id,
+        _data={"name": "new beautiful name", "viewing_permissions": []},
+        _expected_redirect=url_for("main.choose_template",
+                                   service_id=service_one['id'],
+                                   template_folder_id=folder_id,
+                                   _external=True)
+    )
+
+    mock_update.assert_called_once_with(
+        service_one['id'],
+        folder_id,
+        name="new beautiful name",
+        users_with_permission=[]
     )
 
 
diff --git a/tests/app/notify_client/test_template_folder_client.py b/tests/app/notify_client/test_template_folder_client.py
index bfd615e2f..a679d9e98 100644
--- a/tests/app/notify_client/test_template_folder_client.py
+++ b/tests/app/notify_client/test_template_folder_client.py
@@ -111,13 +111,13 @@ def test_update_template_folder_calls_correct_api_endpoint(mocker):
     some_service_id = uuid.uuid4()
     template_folder_id = uuid.uuid4()
     expected_url = '/service/{}/template-folder/{}'.format(some_service_id, template_folder_id)
-    data = {'name': 'foo'}
+    data = {'name': 'foo', 'users_with_permission': ['some_id']}
 
     client = TemplateFolderAPIClient()
 
     mock_post = mocker.patch('app.notify_client.template_folder_api_client.TemplateFolderAPIClient.post')
 
-    client.update_template_folder(some_service_id, template_folder_id, name='foo')
+    client.update_template_folder(some_service_id, template_folder_id, name='foo', users_with_permission=['some_id'])
 
     mock_post.assert_called_once_with(expected_url, data)
     mock_redis_delete.assert_called_once_with('service-{}-template-folders'.format(some_service_id))

From 86d8464fa2cce72270180662b341a548e2183233 Mon Sep 17 00:00:00 2001
From: Pea Tyczynska <pea.tyczynska@digital.cabinet-office.gov.uk>
Date: Mon, 18 Mar 2019 16:12:12 +0000
Subject: [PATCH 4/5] Show all users in folder viewing permissions, correct
 users checked

---
 app/main/forms.py                             | 12 +++----
 app/main/views/templates.py                   |  9 +++---
 app/templates/components/checkbox.html        | 31 ++++++-------------
 .../templates/manage-template-folder.html     |  4 +--
 4 files changed, 21 insertions(+), 35 deletions(-)

diff --git a/app/main/forms.py b/app/main/forms.py
index 4a1461b2c..701b4a89f 100644
--- a/app/main/forms.py
+++ b/app/main/forms.py
@@ -1285,15 +1285,15 @@ class ReturnedLettersForm(StripWhitespaceForm):
 
 
 class TemplateFolderForm(StripWhitespaceForm):
-    def __init__(self, users_with_permission=None, *args, **kwargs):
+    def __init__(self, all_service_users=None, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        if users_with_permission is not None:
-            self.viewing_permissions.users_with_permission = users_with_permission
-            self.viewing_permissions.choices = [
-                (item.id, item.name) for item in users_with_permission
+        if all_service_users is not None:
+            self.users_with_permission.all_service_users = all_service_users
+            self.users_with_permission.choices = [
+                (item.id, item.name) for item in all_service_users
             ]
 
-    viewing_permissions = MultiCheckboxField('Users who can see this folder:')
+    users_with_permission = MultiCheckboxField('Users who can see this folder:')
     name = StringField('Folder name', validators=[DataRequired(message='Can’t be empty')])
 
 
diff --git a/app/main/views/templates.py b/app/main/views/templates.py
index 5e4410a68..97e1b1515 100644
--- a/app/main/views/templates.py
+++ b/app/main/views/templates.py
@@ -431,19 +431,18 @@ def action_blocked(service_id, notification_type, return_to, template_id):
 @user_has_permissions('manage_templates')
 def manage_template_folder(service_id, template_folder_id):
     current_folder = current_service.get_template_folder(template_folder_id)
-    users_with_folder_permission = [
-        current_service.get_team_member(user_id) for user_id in current_folder['users_with_permission']
-    ]
     form = TemplateFolderForm(
         name=current_folder['name'],
-        users_with_permission=users_with_folder_permission
+        users_with_permission=current_folder.get('users_with_permission', None),
+        all_service_users=[user for user in current_service.active_users if user.id != current_user.id]
     )
     if form.validate_on_submit():
+        users_with_permission = form.users_with_permission.data + [current_user.id]
         template_folder_api_client.update_template_folder(
             current_service.id,
             template_folder_id,
             name=form.name.data,
-            users_with_permission=form.viewing_permissions.data
+            users_with_permission=users_with_permission
         )
         return redirect(
             url_for('.choose_template', service_id=service_id, template_folder_id=template_folder_id)
diff --git a/app/templates/components/checkbox.html b/app/templates/components/checkbox.html
index 8adba1556..51594eea6 100644
--- a/app/templates/components/checkbox.html
+++ b/app/templates/components/checkbox.html
@@ -1,13 +1,12 @@
-{% from "components/select-input.html" import select_nested %}
+{% from "components/select-input.html" import select_nested, select %}
 
 {% macro checkbox(
   field,
   hint=False,
-  width='2-3',
-  value='y'
+  width='2-3'
 ) %}
   <div class="multiple-choice">
-    {{ checkbox_input(field.id, field.name, field.data, value) }}
+    {{ checkbox_input(field.id, field.name, field.data) }}
     <label for="{{ field.id }}">
       {{ field.label.text }}
       {% if hint %}
@@ -21,7 +20,12 @@
 
 
 {% macro checkboxes_nested(field, child_map, hint=None, disable=[], option_hints={}, hide_legend=False) %}
-  {{ select_nested(field, child_map, hint=None, disable=[], option_hints={}, hide_legend=False, input="checkbox") }}
+  {{ select_nested(field, child_map, hint, disable, option_hints, hide_legend, input="checkbox") }}
+{% endmacro %}
+
+
+{% macro checkboxes(field, hint=None, disable=[], option_hints={}, hide_legend=False) %}
+  {{ select(field, hint, disable, option_hints, hide_legend, input="checkbox") }}
 {% endmacro %}
 
 
@@ -40,20 +44,3 @@
     <label></label>
   </div>
 {% endmacro %}
-
-{% macro checkbox_group(
-  legend,
-  fields,
-  set_value=False
-) %}
-  <fieldset class="form-group">
-    <legend class="form-label">
-      {{ legend }}
-    </legend>
-    {% if set_value %}
-      {% for field in fields %}
-        {{ checkbox(field, value=field.data) }}
-      {% endfor %}
-    {% endif %}
-  </fieldset>
-{% endmacro %}
diff --git a/app/templates/views/templates/manage-template-folder.html b/app/templates/views/templates/manage-template-folder.html
index 540609792..43dee3dad 100644
--- a/app/templates/views/templates/manage-template-folder.html
+++ b/app/templates/views/templates/manage-template-folder.html
@@ -1,7 +1,7 @@
 {% extends "withnav_template.html" %}
 {% from "components/folder-path.html" import folder_path, page_title_folder_path %}
 {% from "components/textbox.html" import textbox %}
-{% from "components/checkbox.html" import checkbox, checkbox_group %}
+{% from "components/checkbox.html" import checkbox, checkboxes %}
 {% from "components/page-footer.html" import page_footer %}
 {% from "components/form.html" import form_wrapper %}
 
@@ -25,7 +25,7 @@
   {% call form_wrapper(action=url_for('main.manage_template_folder', service_id=current_service.id, template_folder_id=template_folder_id)) %}
     {{ textbox(form.name) }}
     {% if current_service.has_permission("edit_folder_permissions") %}
-      {{ checkbox_group("Users who can see this folder:", form.viewing_permissions, set_value=True) }}
+      {{ checkboxes(form.users_with_permission) }}
     {% endif %}
 
     {{ page_footer(

From fb5983cc2e9c92826fcb92b1e6b1444b0b22ae89 Mon Sep 17 00:00:00 2001
From: Pea Tyczynska <pea.tyczynska@digital.cabinet-office.gov.uk>
Date: Mon, 18 Mar 2019 16:13:39 +0000
Subject: [PATCH 5/5] Test manage folder viewing permissions page

---
 tests/app/main/views/test_template_folders.py | 68 +++++++++++++------
 1 file changed, 48 insertions(+), 20 deletions(-)

diff --git a/tests/app/main/views/test_template_folders.py b/tests/app/main/views/test_template_folders.py
index c1ba415c4..1b0db751a 100644
--- a/tests/app/main/views/test_template_folders.py
+++ b/tests/app/main/views/test_template_folders.py
@@ -415,25 +415,20 @@ def test_can_create_email_template_with_parent_folder(
         data['parent_folder_id'])
 
 
-@pytest.mark.parametrize("folder_permissions, expected_len", [(['edit_folder_permissions'], 1), ([], 0)])
 def test_get_manage_folder_page(
     client_request,
     active_user_with_permissions,
     service_one,
     mock_get_template_folders,
-    mocker,
-    folder_permissions,
-    expected_len,
+    mocker
 ):
-    service_one["permissions"] += folder_permissions
     folder_id = str(uuid.uuid4())
     mock_get_template_folders.return_value = [
         {'id': folder_id, 'name': 'folder_two', 'parent_id': None, 'users_with_permission': [
             active_user_with_permissions.id
         ]},
     ]
-    mocker.patch('app.models.service.Service.get_team_member', return_value=active_user_with_permissions)
-
+    mocker.patch('app.models.service.Service.active_users', [active_user_with_permissions])
     page = client_request.get(
         'main.manage_template_folder',
         service_id=service_one['id'],
@@ -448,14 +443,46 @@ def test_get_manage_folder_page(
     expected_delete_url = "/services/{}/templates/folders/{}/delete".format(service_one['id'], folder_id)
     assert expected_delete_url in delete_link["href"]
 
+
+def test_get_manage_folder_viewing_permissions_for_users(
+    client_request,
+    active_user_with_permissions,
+    service_one,
+    mock_get_template_folders,
+    mocker
+):
+    folder_id = str(uuid.uuid4())
+    team_member = active_user_view_permissions(str(uuid.uuid4()))
+    team_member_2 = active_user_view_permissions(str(uuid.uuid4()))
+    service_one["permissions"] += ["edit_folder_permissions"]
+    mock_get_template_folders.return_value = [
+        {'id': folder_id, 'name': 'folder_two', 'parent_id': None, 'users_with_permission': [
+            active_user_with_permissions.id, team_member_2.id
+        ]},
+    ]
+    mocker.patch('app.models.service.Service.active_users', [active_user_with_permissions, team_member, team_member_2])
+
+    page = client_request.get(
+        'main.manage_template_folder',
+        service_id=service_one['id'],
+        template_folder_id=folder_id,
+        _test_page_title=False,
+    )
+    assert normalize_spaces(page.select_one('title').text) == (
+        'folder_two – Templates – service one – GOV.UK Notify'
+    )
     form_labels = page.select('legend[class=form-label]')
-    assert len(form_labels) == expected_len
-    if expected_len == 1:
-        assert "Users who can see this folder:" in form_labels[0].text
-        checkboxes = page.select('input[name=viewing_permissions]')
-        assert len(checkboxes) == 1
-        assert checkboxes[0]['value'] == active_user_with_permissions.id
-        assert "Test User" in page.findAll('label', {'for': 'viewing_permissions-0'})[0].text
+    assert "Users who can see this folder:" in form_labels[0].text
+    checkboxes = page.select('input[name=users_with_permission]')
+
+    assert len(checkboxes) == 2
+    assert checkboxes[0]['value'] == team_member.id
+    assert "checked" not in checkboxes[0].attrs
+
+    assert checkboxes[1]['value'] == team_member_2.id
+    assert "checked" in checkboxes[1].attrs
+
+    assert "Test User" in page.findAll('label', {'for': 'users_with_permission-0'})[0].text
 
 
 def test_manage_folder_page_404s(client_request, service_one, mock_get_template_folders):
@@ -488,13 +515,13 @@ def test_rename_folder(client_request, active_user_with_permissions, service_one
             active_user_with_permissions.id
         ]}
     ]
-    mocker.patch('app.models.service.Service.get_team_member', return_value=active_user_with_permissions)
+    mocker.patch('app.models.service.Service.active_users', [active_user_with_permissions])
 
     client_request.post(
         'main.manage_template_folder',
         service_id=service_one['id'],
         template_folder_id=folder_id,
-        _data={"name": "new beautiful name", "viewing_permissions": [active_user_with_permissions.id]},
+        _data={"name": "new beautiful name", "users_with_permission": []},
         _expected_redirect=url_for("main.choose_template",
                                    service_id=service_one['id'],
                                    template_folder_id=folder_id,
@@ -512,20 +539,21 @@ def test_rename_folder(client_request, active_user_with_permissions, service_one
 def test_manage_folder_users(
     client_request, active_user_with_permissions, service_one, mock_get_template_folders, mocker
 ):
+    team_member = active_user_view_permissions(str(uuid.uuid4()))
     mock_update = mocker.patch('app.template_folder_api_client.update_template_folder')
     folder_id = str(uuid.uuid4())
     mock_get_template_folders.return_value = [
         {'id': folder_id, 'name': 'folder_two', 'parent_id': None, 'users_with_permission': [
-            active_user_with_permissions.id
+            active_user_with_permissions.id, team_member.id
         ]}
     ]
-    mocker.patch('app.models.service.Service.get_team_member', return_value=active_user_with_permissions)
+    mocker.patch('app.models.service.Service.active_users', [active_user_with_permissions, team_member])
 
     client_request.post(
         'main.manage_template_folder',
         service_id=service_one['id'],
         template_folder_id=folder_id,
-        _data={"name": "new beautiful name", "viewing_permissions": []},
+        _data={"name": "new beautiful name", "users_with_permission": []},
         _expected_redirect=url_for("main.choose_template",
                                    service_id=service_one['id'],
                                    template_folder_id=folder_id,
@@ -536,7 +564,7 @@ def test_manage_folder_users(
         service_one['id'],
         folder_id,
         name="new beautiful name",
-        users_with_permission=[]
+        users_with_permission=[active_user_with_permissions.id]
     )