diff --git a/app/assets/error_pages/404_cloudfront.html b/app/assets/error_pages/404_cloudfront.html new file mode 100644 index 000000000..2af708ad6 --- /dev/null +++ b/app/assets/error_pages/404_cloudfront.html @@ -0,0 +1,8 @@ + + + 404 - Not found + + +

404 - Not found

+ + diff --git a/app/main/__init__.py b/app/main/__init__.py index 03855f594..de243703f 100644 --- a/app/main/__init__.py +++ b/app/main/__init__.py @@ -24,7 +24,6 @@ from app.main.views import ( api_keys, manage_users, invites, - all_services, feedback, providers, platform_admin, diff --git a/app/main/forms.py b/app/main/forms.py index f4c2f6a39..650f72891 100644 --- a/app/main/forms.py +++ b/app/main/forms.py @@ -21,7 +21,7 @@ from wtforms import ( from wtforms.fields.html5 import EmailField, TelField from wtforms.validators import (DataRequired, Email, Length, Regexp, Optional) -from app.main.validators import (Blacklist, CsvFileValidator, ValidEmailDomainRegex, NoCommasInPlaceHolders) +from app.main.validators import (Blacklist, CsvFileValidator, ValidGovEmail, NoCommasInPlaceHolders) def get_time_value_and_label(future_time): @@ -48,12 +48,16 @@ def get_next_hours_from(now, hours=23): ] -def email_address(label='Email address'): - return EmailField(label, validators=[ +def email_address(label='Email address', gov_user=True): + validators = [ Length(min=5, max=255), DataRequired(message='Can’t be empty'), - Email(message='Enter a valid email address'), - ValidEmailDomainRegex()]) + Email(message='Enter a valid email address') + ] + + if gov_user: + validators.append(ValidGovEmail()) + return EmailField(label, validators) class UKMobileNumber(TelField): @@ -126,7 +130,7 @@ class PermissionsForm(Form): class InviteUserForm(PermissionsForm): - email_address = email_address('Email address') + email_address = email_address(gov_user=False) def __init__(self, invalid_email_address, *args, **kwargs): super(InviteUserForm, self).__init__(*args, **kwargs) @@ -242,7 +246,7 @@ class EmailTemplateForm(SMSTemplateForm): class ForgotPasswordForm(Form): - email_address = email_address() + email_address = email_address(gov_user=False) class NewPasswordForm(Form): diff --git a/app/main/validators.py b/app/main/validators.py index 6b92f64a2..c44b9774d 100644 --- a/app/main/validators.py +++ b/app/main/validators.py @@ -1,7 +1,9 @@ -import re from wtforms import ValidationError from notifications_utils.template import Template -from app.utils import Spreadsheet +from app.utils import ( + Spreadsheet, + is_gov_user +) from ._blacklisted_passwords import blacklisted_passwords @@ -26,17 +28,15 @@ class CsvFileValidator(object): raise ValidationError("{} isn’t a spreadsheet that Notify can read".format(field.data.filename)) -class ValidEmailDomainRegex(object): +class ValidGovEmail(object): def __call__(self, form, field): - from flask import (current_app, url_for) + from flask import url_for message = ( 'Enter a central government email address.' ' If you think you should have access' ' contact us').format(url_for('main.feedback')) - valid_domains = current_app.config.get('EMAIL_DOMAIN_REGEXES', []) - email_regex = "[^\@^\s]+@([^@^\\.^\\s]+\.)*({})$".format("|".join(valid_domains)) - if not re.match(email_regex, field.data.lower()): + if not is_gov_user(field.data.lower()): raise ValidationError(message) diff --git a/app/main/views/add_service.py b/app/main/views/add_service.py index 7fa36a05d..3f8a5e064 100644 --- a/app/main/views/add_service.py +++ b/app/main/views/add_service.py @@ -3,9 +3,15 @@ from flask import ( redirect, session, url_for, - current_app) + current_app +) -from flask_login import login_required +from flask_login import ( + current_user, + login_required +) + +from werkzeug.exceptions import abort from app.main import main from app.main.forms import AddServiceForm @@ -16,7 +22,32 @@ from app import ( user_api_client, service_api_client ) -from app.utils import email_safe + +from app.utils import ( + email_safe, + is_gov_user +) + + +def _add_invited_user_to_service(invited_user): + invitation = InvitedUser(**invited_user) + # if invited user add to service and redirect to dashboard + user = user_api_client.get_user(session['user_id']) + service_id = invited_user['service'] + user_api_client.add_user_to_service(service_id, user.id, invitation.permissions) + invite_api_client.accept_invite(service_id, invitation.id) + return service_id + + +def _create_service(service_name, email_from): + service_id = service_api_client.create_service(service_name=service_name, + active=False, + message_limit=current_app.config['DEFAULT_SERVICE_LIMIT'], + restricted=True, + user_id=session['user_id'], + email_from=email_from) + session['service_id'] = service_id + return service_id @main.route("/add-service", methods=['GET', 'POST']) @@ -24,25 +55,19 @@ from app.utils import email_safe def add_service(): invited_user = session.get('invited_user') if invited_user: - invitation = InvitedUser(**invited_user) - # if invited user add to service and redirect to dashboard - user = user_api_client.get_user(session['user_id']) - service_id = invited_user['service'] - user_api_client.add_user_to_service(service_id, user.id, invitation.permissions) - invite_api_client.accept_invite(service_id, invitation.id) + service_id = _add_invited_user_to_service(invited_user) return redirect(url_for('main.service_dashboard', service_id=service_id)) + if not is_gov_user(current_user.email_address): + abort(403) + form = AddServiceForm(service_api_client.find_all_service_email_from) heading = 'Which service do you want to set up notifications for?' + if form.validate_on_submit(): email_from = email_safe(form.name.data) - service_id = service_api_client.create_service(service_name=form.name.data, - active=False, - message_limit=current_app.config['DEFAULT_SERVICE_LIMIT'], - restricted=True, - user_id=session['user_id'], - email_from=email_from) - session['service_id'] = service_id + service_name = form.name.data + service_id = _create_service(service_name, email_from) if (len(service_api_client.get_services({'user_id': session['user_id']}).get('data', [])) > 1): return redirect(url_for('main.service_dashboard', service_id=service_id)) diff --git a/app/main/views/all_services.py b/app/main/views/all_services.py deleted file mode 100644 index cb1cc8b28..000000000 --- a/app/main/views/all_services.py +++ /dev/null @@ -1,15 +0,0 @@ -from flask import render_template -from flask_login import login_required - -from app import service_api_client -from app.main import main -from app.utils import user_has_permissions -from app.notify_client.service_api_client import ServicesBrowsableItem - - -@main.route("/all-services") -@login_required -@user_has_permissions(None, admin_override=True) -def show_all_services(): - services = [ServicesBrowsableItem(x) for x in service_api_client.get_services()['data']] - return render_template('views/all-services.html', services=services) diff --git a/app/main/views/choose_service.py b/app/main/views/choose_service.py index 4b5f27f47..d5cd2e6b9 100644 --- a/app/main/views/choose_service.py +++ b/app/main/views/choose_service.py @@ -3,6 +3,7 @@ from flask_login import login_required, current_user from app.main import main from app import service_api_client from app.notify_client.service_api_client import ServicesBrowsableItem +from app.utils import is_gov_user @main.route("/services") @@ -11,7 +12,8 @@ def choose_service(): return render_template( 'views/choose-service.html', services=[ServicesBrowsableItem(x) for x in - service_api_client.get_services({'user_id': current_user.id})['data']] + service_api_client.get_services({'user_id': current_user.id})['data']], + can_add_service=is_gov_user(current_user.email_address) ) diff --git a/app/main/views/two_factor.py b/app/main/views/two_factor.py index 022a189f5..c4d609d64 100644 --- a/app/main/views/two_factor.py +++ b/app/main/views/two_factor.py @@ -42,7 +42,7 @@ def two_factor(): return redirect(next_url) if current_user.platform_admin: - return redirect(url_for('main.show_all_services')) + return redirect(url_for('main.platform_admin')) if len(services) == 1: return redirect(url_for('main.service_dashboard', service_id=services[0]['id'])) else: diff --git a/app/main/views/user_profile.py b/app/main/views/user_profile.py index 84c13bd81..cc71fc758 100644 --- a/app/main/views/user_profile.py +++ b/app/main/views/user_profile.py @@ -1,6 +1,7 @@ import json from flask import ( + abort, render_template, redirect, url_for, @@ -21,6 +22,8 @@ from app.main.forms import ( ConfirmPasswordForm ) +from app.utils import is_gov_user + from app import user_api_client NEW_EMAIL = 'new-email' @@ -31,7 +34,10 @@ NEW_MOBILE_PASSWORD_CONFIRMED = 'new-mob-password-confirmed' @main.route("/user-profile") @login_required def user_profile(): - return render_template('views/user-profile.html') + return render_template( + 'views/user-profile.html', + can_see_edit=is_gov_user(current_user.email_address) + ) @main.route("/user-profile/name", methods=['GET', 'POST']) @@ -56,6 +62,9 @@ def user_profile_name(): @login_required def user_profile_email(): + if not is_gov_user(current_user.email_address): + abort(403) + def _is_email_unique(email): return user_api_client.is_email_unique(email) form = ChangeEmailForm(_is_email_unique, diff --git a/app/templates/views/choose-service.html b/app/templates/views/choose-service.html index 5087d2a3c..fbc55ba4d 100644 --- a/app/templates/views/choose-service.html +++ b/app/templates/views/choose-service.html @@ -12,12 +12,14 @@ {{ browse_list(services) }} - {{ browse_list([ - { - 'title': 'Add a new service…', - 'link': url_for('.add_service') - }, - ]) }} + {% if can_add_service %} + {{ browse_list([ + { + 'title': 'Add a new service…', + 'link': url_for('.add_service') + }, + ]) }} + {% endif %} {% endblock %} diff --git a/app/templates/views/invite-user.html b/app/templates/views/invite-user.html index 83afb4214..ee392d935 100644 --- a/app/templates/views/invite-user.html +++ b/app/templates/views/invite-user.html @@ -16,7 +16,7 @@ Manage users – GOV.UK Notify
- {{ textbox(form.email_address, hint='Must be from a central government organisation', width='1-1', safe_error_message=True) }} + {{ textbox(form.email_address, width='1-1', safe_error_message=True) }} {% include 'views/manage-users/permissions.html' %} diff --git a/app/templates/views/service-settings/request-to-go-live.html b/app/templates/views/service-settings/request-to-go-live.html index 57ac237d9..d64bc2fa5 100644 --- a/app/templates/views/service-settings/request-to-go-live.html +++ b/app/templates/views/service-settings/request-to-go-live.html @@ -20,7 +20,7 @@ {% endcall %}

- Before you request to go live, make you you’ve: + Before you request to go live, make sure you’ve: