From da84a18970f4a3ae847248a880ba04f957a71016 Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Mon, 3 Jul 2023 15:03:33 -0400 Subject: [PATCH] Ensure users are authenticated for most pages (#586) * Ensure users are authenticated for most pages This changeset makes sure that users must be authenticated and logged in to view most pages of the Notify service. We are moving to a model where only the home page and a select few others will be publicly accessible for the time being. Signed-off-by: Carlo Costino --- app/main/views/index.py | 23 +++++++++++++++++++++-- app/main/views/pricing.py | 4 ++++ tests/app/main/views/test_index.py | 14 +++++++++----- 3 files changed, 34 insertions(+), 7 deletions(-) diff --git a/app/main/views/index.py b/app/main/views/index.py index 7c418d179..dea9852ef 100644 --- a/app/main/views/index.py +++ b/app/main/views/index.py @@ -18,7 +18,7 @@ from app.main.views.sub_navigation_dictionaries import ( features_nav, using_notify_nav, ) -from app.utils import hide_from_search_engines +from app.utils.user import user_is_logged_in @main.route('/') @@ -42,11 +42,13 @@ def error(status_code): @main.route('/privacy') +@user_is_logged_in def privacy(): return render_template('views/privacy.html') @main.route('/accessibility-statement') +@user_is_logged_in def accessibility_statement(): return render_template('views/accessibility_statement.html') @@ -58,11 +60,13 @@ def delivery_and_failure(): @main.route('/design-patterns-content-guidance') +@user_is_logged_in def design_content(): return redirect('https://www.gov.uk/service-manual/design/sending-emails-and-text-messages', 301) @main.route('/_email') +@user_is_logged_in def email_template(): branding_type = 'govuk' branding_style = request.args.get('branding_style', None) @@ -152,6 +156,7 @@ def email_template(): @main.route('/documentation') +@user_is_logged_in def documentation(): return render_template( 'views/documentation.html', @@ -172,6 +177,7 @@ def callbacks(): # --- Features page set --- # @main.route('/features') +@user_is_logged_in def features(): return render_template( 'views/features.html', @@ -180,6 +186,7 @@ def features(): @main.route('/features/roadmap', endpoint='roadmap') +@user_is_logged_in def roadmap(): return render_template( 'views/roadmap.html', @@ -188,7 +195,7 @@ def roadmap(): @main.route('/features/email') -@hide_from_search_engines +@user_is_logged_in def features_email(): return render_template( 'views/features/emails.html', @@ -197,6 +204,7 @@ def features_email(): @main.route('/features/sms') +@user_is_logged_in def features_sms(): return render_template( 'views/features/text-messages.html', @@ -205,6 +213,7 @@ def features_sms(): @main.route('/features/security', endpoint='security') +@user_is_logged_in def security(): return render_template( 'views/security.html', @@ -213,6 +222,7 @@ def security(): @main.route('/features/terms', endpoint='terms') +@user_is_logged_in def terms(): return render_template( 'views/terms-of-use.html', @@ -221,6 +231,7 @@ def terms(): @main.route('/features/using-notify') +@user_is_logged_in def using_notify(): return render_template( 'views/using-notify.html', @@ -229,6 +240,7 @@ def using_notify(): @main.route('/using-notify/delivery-status') +@user_is_logged_in def message_status(): return render_template( 'views/message-status.html', @@ -237,11 +249,13 @@ def message_status(): @main.route('/features/get-started') +@user_is_logged_in def get_started_old(): return redirect(url_for('.get_started'), 301) @main.route('/using-notify/get-started') +@user_is_logged_in def get_started(): return render_template( 'views/get-started.html', @@ -269,6 +283,7 @@ def trial_mode_new(): @main.route('/using-notify/guidance') +@user_is_logged_in def guidance_index(): return render_template( 'views/guidance/index.html', @@ -277,6 +292,7 @@ def guidance_index(): @main.route('/using-notify/guidance/branding-and-customisation') +@user_is_logged_in def branding_and_customisation(): return render_template( 'views/guidance/branding-and-customisation.html', @@ -285,6 +301,7 @@ def branding_and_customisation(): @main.route('/using-notify/guidance/create-and-send-messages') +@user_is_logged_in def create_and_send_messages(): return render_template( 'views/guidance/create-and-send-messages.html', @@ -293,6 +310,7 @@ def create_and_send_messages(): @main.route('/using-notify/guidance/edit-and-format-messages') +@user_is_logged_in def edit_and_format_messages(): return render_template( 'views/guidance/edit-and-format-messages.html', @@ -301,6 +319,7 @@ def edit_and_format_messages(): @main.route('/using-notify/guidance/send-files-by-email') +@user_is_logged_in def send_files_by_email(): return render_template( 'views/guidance/send-files-by-email.html', diff --git a/app/main/views/pricing.py b/app/main/views/pricing.py index 18a3d426a..bdbc0a454 100644 --- a/app/main/views/pricing.py +++ b/app/main/views/pricing.py @@ -7,11 +7,13 @@ from notifications_utils.international_billing_rates import ( from app.main import main from app.main.forms import SearchByNameForm from app.main.views.sub_navigation_dictionaries import using_notify_nav +from app.utils.user import user_is_logged_in CURRENT_SMS_RATE = '1.72' @main.route('/using-notify/pricing') +@user_is_logged_in def pricing(): return render_template( 'views/pricing/index.html', @@ -26,6 +28,7 @@ def pricing(): @main.route('/pricing/how-to-pay') +@user_is_logged_in def how_to_pay(): return render_template( 'views/pricing/how-to-pay.html', @@ -34,6 +37,7 @@ def how_to_pay(): @main.route('/pricing/billing-details') +@user_is_logged_in def billing_details(): if current_user.is_authenticated: return render_template( diff --git a/tests/app/main/views/test_index.py b/tests/app/main/views/test_index.py index 2e17dfeb9..08286faf9 100644 --- a/tests/app/main/views/test_index.py +++ b/tests/app/main/views/test_index.py @@ -71,7 +71,6 @@ def test_robots(client_request): ('bat_phone', {}), ('thanks', {}), ('register', {}), - ('features_email', {}), pytest.param('index', {}, marks=pytest.mark.xfail(raises=AssertionError)), )) @freeze_time('2012-12-12 12:12') # So we don’t go out of business hours @@ -116,12 +115,17 @@ def test_static_pages( session['service_id'] = None request() - # Check it still works when they sign out + # Check it redirects to the login screen when they sign out client_request.logout() with client_request.session_transaction() as session: session['service_id'] = None session['user_id'] = None - request() + request( + _expected_status=302, + _expected_redirect='/sign-in?next={}'.format( + url_for('main.{}'.format(view)) + ) + ) def test_guidance_pages_link_to_service_pages_when_signed_in( @@ -143,12 +147,12 @@ def test_guidance_pages_link_to_service_pages_when_signed_in( page = request() assert not page.select_one(selector) - # Check it still works when they sign out + # Check it redirects to the login screen when they sign out client_request.logout() with client_request.session_transaction() as session: session['service_id'] = None session['user_id'] = None - page = request() + page = request(_expected_status=302) assert not page.select_one(selector)