Merge pull request #1435 from alphagov/manage-templates-permission

Separate ‘manage service’ and ‘manage templates’ permissions

app/assets/stylesheets/components/tick-cross.scss

@@ -4,8 +4,8 @@
   display: inline-block;
   background-size: 19px 19px;
   background-repeat: no-repeat;
-  background-position: 0 0;
-  padding: 1px 0 0 25px;
+  background-position: 0 6px;
+  padding: 6px 0 5px 25px;
 
   @include ie-lte(8) {
     background-position: 0 3px;
@@ -31,6 +31,7 @@
     @extend %tick-cross;
     color: $secondary-text-colour;
     background-image: file-url('cross-grey.png');
+    box-shadow: inset 20px 0 0 0 rgba(255, 255, 255, 0.6);
 
     @include ie-lte(8) {
       background-image: file-url('cross-grey-16px.png');
@@ -42,21 +43,24 @@
 
     @extend %grid-row;
     margin-top: 5px;
+    position: relative;
 
     &-permissions {
 
       @include grid-column(3/4);
 
       li {
-        display: inline-block;
+        display: block;
         margin-right: 0.5em;
       }
 
     }
 
     &-edit-link {
-      @include grid-column(1/4);
       text-align: right;
+      position: absolute;
+      top: -1.6em;
+      right: -135px;
     }
 
   }

app/assets/stylesheets/views/users.scss

@@ -5,7 +5,7 @@
 
   &-item {
 
-    padding: $gutter-half 0;
+    padding: $gutter-half 150px $gutter-half 0;
     border-top: 1px solid $border-colour;
 
     &:last-child {

app/main/forms.py

@@ -171,7 +171,8 @@ class RegisterUserFromInviteForm(Form):
 
 class PermissionsForm(Form):
     send_messages = BooleanField("Send messages from existing templates")
-    manage_service = BooleanField("Modify this service, its team, and its templates")
+    manage_templates = BooleanField("Add and edit templates")
+    manage_service = BooleanField("Modify this service and its team")
     manage_api_keys = BooleanField("Create and revoke API keys")
 
 

app/main/views/manage_users.py

@@ -25,7 +25,8 @@ from app.utils import user_has_permissions
 
 roles = {
     'send_messages': ['send_texts', 'send_emails', 'send_letters'],
-    'manage_service': ['manage_users', 'manage_templates', 'manage_settings'],
+    'manage_templates': ['manage_templates'],
+    'manage_service': ['manage_users', 'manage_settings'],
     'manage_api_keys': ['manage_api_keys']
 }
 
@@ -54,14 +55,7 @@ def invite_user(service_id):
 
     if form.validate_on_submit():
         email_address = form.email_address.data
-        # view_activity is a default role to be added to all users.
-        # All users will have at minimum view_activity to allow users to see notifications,
-        # templates, team members but no update privileges
-        selected_permissions = [permissions for role, permissions in roles.items() if request.form.get(role) == 'y']
-        selected_permissions = list(chain.from_iterable(selected_permissions))
-        selected_permissions.append('view_activity')
-        selected_permissions.sort()
-        permissions = ','.join(selected_permissions)
+        permissions = ','.join(sorted(get_permissions_from_form(form)))
         invited_user = invite_api_client.create_invite(
             current_user.id,
             service_id,
@@ -94,9 +88,7 @@ def edit_user_permissions(service_id, user_id):
     if form.validate_on_submit():
         user_api_client.set_user_permissions(
             user_id, service_id,
-            permissions=set(chain.from_iterable(
-                permissions for role, permissions in roles.items() if form[role].data
-            )) | {'view_activity'}
+            permissions=set(get_permissions_from_form(form)),
         )
         return redirect(url_for('.manage_users', service_id=service_id))
 
@@ -150,3 +142,17 @@ def cancel_invited_user(service_id, invited_user_id):
     invite_api_client.cancel_invited_user(service_id=service_id, invited_user_id=invited_user_id)
 
     return redirect(url_for('main.manage_users', service_id=service_id))
+
+
+def get_permissions_from_form(form):
+    # view_activity is a default role to be added to all users.
+    # All users will have at minimum view_activity to allow users to see notifications,
+    # templates, team members but no update privileges
+    selected_permissions = [
+        permissions
+        for role, permissions in roles.items()
+        if form[role].data is True
+    ]
+    selected_permissions = list(chain.from_iterable(selected_permissions))
+    selected_permissions.append('view_activity')
+    return selected_permissions

app/templates/views/edit-user-permissions.html

@@ -3,7 +3,7 @@
 {% from "components/page-footer.html" import page_footer %}
 
 {% block service_page_title %}
-Manage users
+  {{ user.name or user.email_localpart }}
 {% endblock %}
 
 {% block maincolumn_content %}

app/templates/views/invite-user.html

@@ -4,13 +4,13 @@
 {% from "components/page-footer.html" import page_footer %}
 
 {% block service_page_title %}
-Manage users
+  Invite a team member
 {% endblock %}
 
 {% block maincolumn_content %}
 
   <h1 class="heading-large">
-    {{ "Invite a team member" }}
+    Invite a team member
   </h1>
 
   <div class="grid-row">

app/templates/views/manage-users.html

@@ -12,7 +12,7 @@
 } %}
 
 {% block service_page_title %}
-Manage users
+  Team members
 {% endblock %}
 
 {% block maincolumn_content %}
@@ -37,7 +37,7 @@ Manage users
     {% for user in users %}
       <div class="user-list-item">
         <h3>
-          {{ user.name }}&ensp;<span class="hint">
+          <span class="heading-small">{{ user.name }}</span>&ensp;<span class="hint">
             {%- if user.email_address == current_user.email_address -%}
               (you)
             {% else %}
@@ -52,7 +52,11 @@ Manage users
               'Send messages'
             ) }}
             {{ tick_cross(
-              user.has_permissions(permissions=['manage_users', 'manage_templates', 'manage_settings']),
+              user.has_permissions(permissions=['manage_templates']),
+              'Manage templates'
+            ) }}
+            {{ tick_cross(
+              user.has_permissions(permissions=['manage_users', 'manage_settings']),
               'Manage service'
             ) }}
             {{ tick_cross(
@@ -80,7 +84,7 @@ Manage users
       {% for user in invited_users %}
         <div class="user-list-item">
           <h3>
-            {{ user.email_address }}
+            <span style="font-weight: bold">{{ user.email_address }}</span>
           </h3>
           <ul class="tick-cross-list">
             <div class="tick-cross-list-permissions">
@@ -89,7 +93,11 @@ Manage users
                 'Send messages'
               ) }}
               {{ tick_cross(
-                user.has_permissions(permissions=['manage_users', 'manage_templates', 'manage_settings']),
+                user.has_permissions(permissions=['manage_templates']),
+                'Edit templates'
+              ) }}
+              {{ tick_cross(
+                user.has_permissions(permissions=['manage_users', 'manage_settings']),
                 'Manage service'
               ) }}
               {{ tick_cross(

app/templates/views/manage-users/permissions.html

@@ -5,6 +5,7 @@
     Permissions
   </legend>
   {{ checkbox(form.send_messages) }}
+  {{ checkbox(form.manage_templates) }}
   {{ checkbox(form.manage_service) }}
   {{ checkbox(form.manage_api_keys) }}
 </fieldset>