Merge pull request #3015 from alphagov/optional-platform-admin

add option to suppress platform admin temporarily

app/main/views/user_profile.py

@@ -1,6 +1,13 @@
 import json
 
-from flask import current_app, redirect, render_template, session, url_for
+from flask import (
+    abort,
+    current_app,
+    redirect,
+    render_template,
+    session,
+    url_for,
+)
 from flask_login import current_user, login_required
 from notifications_utils.url_safe_token import check_token
 
@@ -12,6 +19,7 @@ from app.main.forms import (
     ChangeNameForm,
     ChangePasswordForm,
     ConfirmPasswordForm,
+    ServiceOnOffSettingForm,
     TwoFactorForm,
 )
 from app.models.user import User
@@ -192,3 +200,26 @@ def user_profile_password():
         'views/user-profile/change-password.html',
         form=form
     )
+
+
+@main.route("/user-profile/disable-platform-admin-view", methods=['GET', 'POST'])
+@login_required
+def user_profile_disable_platform_admin_view():
+    if not current_user.platform_admin and not session.get('disable_platform_admin_view'):
+        abort(403)
+
+    form = ServiceOnOffSettingForm(
+        name="Signing in again clears this setting",
+        enabled=not session.get('disable_platform_admin_view'),
+        truthy='Yes',
+        falsey='No',
+    )
+
+    if form.validate_on_submit():
+        session['disable_platform_admin_view'] = not form.enabled.data
+        return redirect(url_for('.user_profile'))
+
+    return render_template(
+        'views/user-profile/disable-platform-admin-view.html',
+        form=form
+    )

app/models/user.py

@@ -48,6 +48,7 @@ class User(JSONModel, UserMixin):
         super().__init__(_dict)
         self.permissions = _dict.get('permissions', {})
         self.max_failed_login_count = current_app.config['MAX_FAILED_LOGIN_COUNT']
+        self._platform_admin = _dict['platform_admin']
 
     @classmethod
     def from_id(cls, user_id):
@@ -172,6 +173,10 @@ class User(JSONModel, UserMixin):
             super(User, self).is_authenticated
         )
 
+    @property
+    def platform_admin(self):
+        return self._platform_admin and not session.get('disable_platform_admin_view', False)
+
     def has_permissions(self, *permissions, restrict_admin_usage=False):
         unknown_permissions = set(permissions) - all_permissions
         if unknown_permissions:

app/navigation.py

@@ -77,6 +77,7 @@ class HeaderNavigation(Navigation):
             'user_profile_mobile_number_confirm',
             'user_profile_name',
             'user_profile_password',
+            'user_profile_disable_platform_admin_view',
         },
         'platform-admin': {
             'add_organisation',
@@ -571,6 +572,7 @@ class MainNavigation(Navigation):
         'user_profile_mobile_number_confirm',
         'user_profile_name',
         'user_profile_password',
+        'user_profile_disable_platform_admin_view',
         'using_notify',
         'verify',
         'verify_email',
@@ -838,6 +840,7 @@ class CaseworkNavigation(Navigation):
         'user_profile_mobile_number_confirm',
         'user_profile_name',
         'user_profile_password',
+        'user_profile_disable_platform_admin_view',
         'using_notify',
         'verify',
         'verify_email',
@@ -1106,6 +1109,7 @@ class OrgNavigation(Navigation):
         'user_profile_mobile_number_confirm',
         'user_profile_name',
         'user_profile_password',
+        'user_profile_disable_platform_admin_view',
         'using_notify',
         'verify',
         'verify_email',

app/templates/views/user-profile.html

@@ -45,6 +45,14 @@
         {{ edit_field('Change', url_for('.user_profile_password')) }}
       {% endcall %}
 
+      {% if current_user.platform_admin or session.get('disable_platform_admin_view') %}
+        {% call row() %}
+          {{ text_field('Use platform admin view') }}
+          {{ text_field('Yes' if not session.get('disable_platform_admin_view') else 'No') }}
+          {{ edit_field('Change', url_for('.user_profile_disable_platform_admin_view')) }}
+        {% endcall %}
+      {% endif %}
+
     {% endcall %}
   </div>
 

app/templates/views/user-profile/disable-platform-admin-view.html

@@ -0,0 +1,27 @@
+{% extends "withoutnav_template.html" %}
+{% from "components/form.html" import form_wrapper %}
+{% from "components/page-footer.html" import page_footer %}
+{% from "components/page-header.html" import page_header %}
+{% from "components/radios.html" import radios %}
+
+{% block per_page_title %}
+  Use platform admin view
+{% endblock %}
+
+{% block maincolumn_content %}
+
+  <div class="grid-row">
+    <div class="column-five-sixths">
+      {{ page_header(
+        'Use platform admin view',
+        back_link=url_for('.user_profile')
+      ) }}
+
+      {% call form_wrapper() %}
+        {{ radios(form.enabled) }}
+        {{ page_footer('Save') }}
+      {% endcall %}
+    </div>
+  </div>
+
+{% endblock %}