Merge branch 'master' of github.com:alphagov/notifications-admin into letters-flag

app/main/__init__.py

@@ -24,7 +24,6 @@ from app.main.views import (
     api_keys,
     manage_users,
     invites,
-    all_services,
     feedback,
     providers,
     platform_admin,

app/main/forms.py

@@ -21,7 +21,7 @@ from wtforms import (
 from wtforms.fields.html5 import EmailField, TelField
 from wtforms.validators import (DataRequired, Email, Length, Regexp, Optional)
 
-from app.main.validators import (Blacklist, CsvFileValidator, ValidEmailDomainRegex, NoCommasInPlaceHolders)
+from app.main.validators import (Blacklist, CsvFileValidator, ValidGovEmail, NoCommasInPlaceHolders)
 
 
 def get_time_value_and_label(future_time):
@@ -48,12 +48,16 @@ def get_next_hours_from(now, hours=23):
     ]
 
 
-def email_address(label='Email address'):
-    return EmailField(label, validators=[
+def email_address(label='Email address', gov_user=True):
+    validators = [
         Length(min=5, max=255),
         DataRequired(message='Can’t be empty'),
-        Email(message='Enter a valid email address'),
-        ValidEmailDomainRegex()])
+        Email(message='Enter a valid email address')
+    ]
+
+    if gov_user:
+        validators.append(ValidGovEmail())
+    return EmailField(label, validators)
 
 
 class UKMobileNumber(TelField):
@@ -126,7 +130,7 @@ class PermissionsForm(Form):
 
 
 class InviteUserForm(PermissionsForm):
-    email_address = email_address('Email address')
+    email_address = email_address(gov_user=False)
 
     def __init__(self, invalid_email_address, *args, **kwargs):
         super(InviteUserForm, self).__init__(*args, **kwargs)
@@ -242,7 +246,7 @@ class EmailTemplateForm(SMSTemplateForm):
 
 
 class ForgotPasswordForm(Form):
-    email_address = email_address()
+    email_address = email_address(gov_user=False)
 
 
 class NewPasswordForm(Form):

app/main/validators.py

@@ -1,7 +1,9 @@
-import re
 from wtforms import ValidationError
 from notifications_utils.template import Template
-from app.utils import Spreadsheet
+from app.utils import (
+    Spreadsheet,
+    is_gov_user
+)
 from ._blacklisted_passwords import blacklisted_passwords
 
 
@@ -26,17 +28,15 @@ class CsvFileValidator(object):
             raise ValidationError("{} isn’t a spreadsheet that Notify can read".format(field.data.filename))
 
 
-class ValidEmailDomainRegex(object):
+class ValidGovEmail(object):
 
     def __call__(self, form, field):
-        from flask import (current_app, url_for)
+        from flask import url_for
         message = (
             'Enter a central government email address.'
             ' If you think you should have access'
             ' <a href="{}">contact us</a>').format(url_for('main.feedback'))
-        valid_domains = current_app.config.get('EMAIL_DOMAIN_REGEXES', [])
-        email_regex = "[^\@^\s]+@([^@^\\.^\\s]+\.)*({})$".format("|".join(valid_domains))
-        if not re.match(email_regex, field.data.lower()):
+        if not is_gov_user(field.data.lower()):
             raise ValidationError(message)
 
 

app/main/views/add_service.py

@@ -3,9 +3,15 @@ from flask import (
     redirect,
     session,
     url_for,
-    current_app)
+    current_app
+)
 
-from flask_login import login_required
+from flask_login import (
+    current_user,
+    login_required
+)
+
+from werkzeug.exceptions import abort
 
 from app.main import main
 from app.main.forms import AddServiceForm
@@ -16,7 +22,32 @@ from app import (
     user_api_client,
     service_api_client
 )
-from app.utils import email_safe
+
+from app.utils import (
+    email_safe,
+    is_gov_user
+)
+
+
+def _add_invited_user_to_service(invited_user):
+    invitation = InvitedUser(**invited_user)
+    # if invited user add to service and redirect to dashboard
+    user = user_api_client.get_user(session['user_id'])
+    service_id = invited_user['service']
+    user_api_client.add_user_to_service(service_id, user.id, invitation.permissions)
+    invite_api_client.accept_invite(service_id, invitation.id)
+    return service_id
+
+
+def _create_service(service_name, email_from):
+    service_id = service_api_client.create_service(service_name=service_name,
+                                                   active=False,
+                                                   message_limit=current_app.config['DEFAULT_SERVICE_LIMIT'],
+                                                   restricted=True,
+                                                   user_id=session['user_id'],
+                                                   email_from=email_from)
+    session['service_id'] = service_id
+    return service_id
 
 
 @main.route("/add-service", methods=['GET', 'POST'])
@@ -24,25 +55,19 @@ from app.utils import email_safe
 def add_service():
     invited_user = session.get('invited_user')
     if invited_user:
-        invitation = InvitedUser(**invited_user)
-        # if invited user add to service and redirect to dashboard
-        user = user_api_client.get_user(session['user_id'])
-        service_id = invited_user['service']
-        user_api_client.add_user_to_service(service_id, user.id, invitation.permissions)
-        invite_api_client.accept_invite(service_id, invitation.id)
+        service_id = _add_invited_user_to_service(invited_user)
         return redirect(url_for('main.service_dashboard', service_id=service_id))
 
+    if not is_gov_user(current_user.email_address):
+        abort(403)
+
     form = AddServiceForm(service_api_client.find_all_service_email_from)
     heading = 'Which service do you want to set up notifications for?'
+
     if form.validate_on_submit():
         email_from = email_safe(form.name.data)
-        service_id = service_api_client.create_service(service_name=form.name.data,
-                                                       active=False,
-                                                       message_limit=current_app.config['DEFAULT_SERVICE_LIMIT'],
-                                                       restricted=True,
-                                                       user_id=session['user_id'],
-                                                       email_from=email_from)
-        session['service_id'] = service_id
+        service_name = form.name.data
+        service_id = _create_service(service_name, email_from)
 
         if (len(service_api_client.get_services({'user_id': session['user_id']}).get('data', [])) > 1):
             return redirect(url_for('main.service_dashboard', service_id=service_id))

app/main/views/all_services.py

@@ -1,15 +0,0 @@
-from flask import render_template
-from flask_login import login_required
-
-from app import service_api_client
-from app.main import main
-from app.utils import user_has_permissions
-from app.notify_client.service_api_client import ServicesBrowsableItem
-
-
-@main.route("/all-services")
-@login_required
-@user_has_permissions(None, admin_override=True)
-def show_all_services():
-    services = [ServicesBrowsableItem(x) for x in service_api_client.get_services()['data']]
-    return render_template('views/all-services.html', services=services)

app/main/views/choose_service.py

@@ -3,6 +3,7 @@ from flask_login import login_required, current_user
 from app.main import main
 from app import service_api_client
 from app.notify_client.service_api_client import ServicesBrowsableItem
+from app.utils import is_gov_user
 
 
 @main.route("/services")
@@ -11,7 +12,8 @@ def choose_service():
     return render_template(
         'views/choose-service.html',
         services=[ServicesBrowsableItem(x) for x in
-                  service_api_client.get_services({'user_id': current_user.id})['data']]
+                  service_api_client.get_services({'user_id': current_user.id})['data']],
+        can_add_service=is_gov_user(current_user.email_address)
     )
 
 

app/main/views/two_factor.py

@@ -42,7 +42,7 @@ def two_factor():
             return redirect(next_url)
 
         if current_user.platform_admin:
-            return redirect(url_for('main.show_all_services'))
+            return redirect(url_for('main.platform_admin'))
         if len(services) == 1:
             return redirect(url_for('main.service_dashboard', service_id=services[0]['id']))
         else:

app/main/views/user_profile.py

@@ -1,6 +1,7 @@
 import json
 
 from flask import (
+    abort,
     render_template,
     redirect,
     url_for,
@@ -21,6 +22,8 @@ from app.main.forms import (
     ConfirmPasswordForm
 )
 
+from app.utils import is_gov_user
+
 from app import user_api_client
 
 NEW_EMAIL = 'new-email'
@@ -31,7 +34,10 @@ NEW_MOBILE_PASSWORD_CONFIRMED = 'new-mob-password-confirmed'
 @main.route("/user-profile")
 @login_required
 def user_profile():
-    return render_template('views/user-profile.html')
+    return render_template(
+        'views/user-profile.html',
+        can_see_edit=is_gov_user(current_user.email_address)
+    )
 
 
 @main.route("/user-profile/name", methods=['GET', 'POST'])
@@ -56,6 +62,9 @@ def user_profile_name():
 @login_required
 def user_profile_email():
 
+    if not is_gov_user(current_user.email_address):
+        abort(403)
+
     def _is_email_unique(email):
         return user_api_client.is_email_unique(email)
     form = ChangeEmailForm(_is_email_unique,