Merge branch 'master' of github.com:alphagov/notifications-admin into letters-flag

app/main/views/add_service.py

@@ -3,9 +3,15 @@ from flask import (
     redirect,
     session,
     url_for,
-    current_app)
+    current_app
+)
 
-from flask_login import login_required
+from flask_login import (
+    current_user,
+    login_required
+)
+
+from werkzeug.exceptions import abort
 
 from app.main import main
 from app.main.forms import AddServiceForm
@@ -16,7 +22,32 @@ from app import (
     user_api_client,
     service_api_client
 )
-from app.utils import email_safe
+
+from app.utils import (
+    email_safe,
+    is_gov_user
+)
+
+
+def _add_invited_user_to_service(invited_user):
+    invitation = InvitedUser(**invited_user)
+    # if invited user add to service and redirect to dashboard
+    user = user_api_client.get_user(session['user_id'])
+    service_id = invited_user['service']
+    user_api_client.add_user_to_service(service_id, user.id, invitation.permissions)
+    invite_api_client.accept_invite(service_id, invitation.id)
+    return service_id
+
+
+def _create_service(service_name, email_from):
+    service_id = service_api_client.create_service(service_name=service_name,
+                                                   active=False,
+                                                   message_limit=current_app.config['DEFAULT_SERVICE_LIMIT'],
+                                                   restricted=True,
+                                                   user_id=session['user_id'],
+                                                   email_from=email_from)
+    session['service_id'] = service_id
+    return service_id
 
 
 @main.route("/add-service", methods=['GET', 'POST'])
@@ -24,25 +55,19 @@ from app.utils import email_safe
 def add_service():
     invited_user = session.get('invited_user')
     if invited_user:
-        invitation = InvitedUser(**invited_user)
-        # if invited user add to service and redirect to dashboard
-        user = user_api_client.get_user(session['user_id'])
-        service_id = invited_user['service']
-        user_api_client.add_user_to_service(service_id, user.id, invitation.permissions)
-        invite_api_client.accept_invite(service_id, invitation.id)
+        service_id = _add_invited_user_to_service(invited_user)
         return redirect(url_for('main.service_dashboard', service_id=service_id))
 
+    if not is_gov_user(current_user.email_address):
+        abort(403)
+
     form = AddServiceForm(service_api_client.find_all_service_email_from)
     heading = 'Which service do you want to set up notifications for?'
+
     if form.validate_on_submit():
         email_from = email_safe(form.name.data)
-        service_id = service_api_client.create_service(service_name=form.name.data,
-                                                       active=False,
-                                                       message_limit=current_app.config['DEFAULT_SERVICE_LIMIT'],
-                                                       restricted=True,
-                                                       user_id=session['user_id'],
-                                                       email_from=email_from)
-        session['service_id'] = service_id
+        service_name = form.name.data
+        service_id = _create_service(service_name, email_from)
 
         if (len(service_api_client.get_services({'user_id': session['user_id']}).get('data', [])) > 1):
             return redirect(url_for('main.service_dashboard', service_id=service_id))

app/main/views/all_services.py

@@ -1,15 +0,0 @@
-from flask import render_template
-from flask_login import login_required
-
-from app import service_api_client
-from app.main import main
-from app.utils import user_has_permissions
-from app.notify_client.service_api_client import ServicesBrowsableItem
-
-
-@main.route("/all-services")
-@login_required
-@user_has_permissions(None, admin_override=True)
-def show_all_services():
-    services = [ServicesBrowsableItem(x) for x in service_api_client.get_services()['data']]
-    return render_template('views/all-services.html', services=services)

app/main/views/choose_service.py

@@ -3,6 +3,7 @@ from flask_login import login_required, current_user
 from app.main import main
 from app import service_api_client
 from app.notify_client.service_api_client import ServicesBrowsableItem
+from app.utils import is_gov_user
 
 
 @main.route("/services")
@@ -11,7 +12,8 @@ def choose_service():
     return render_template(
         'views/choose-service.html',
         services=[ServicesBrowsableItem(x) for x in
-                  service_api_client.get_services({'user_id': current_user.id})['data']]
+                  service_api_client.get_services({'user_id': current_user.id})['data']],
+        can_add_service=is_gov_user(current_user.email_address)
     )
 
 

app/main/views/two_factor.py

@@ -42,7 +42,7 @@ def two_factor():
             return redirect(next_url)
 
         if current_user.platform_admin:
-            return redirect(url_for('main.show_all_services'))
+            return redirect(url_for('main.platform_admin'))
         if len(services) == 1:
             return redirect(url_for('main.service_dashboard', service_id=services[0]['id']))
         else:

app/main/views/user_profile.py

@@ -1,6 +1,7 @@
 import json
 
 from flask import (
+    abort,
     render_template,
     redirect,
     url_for,
@@ -21,6 +22,8 @@ from app.main.forms import (
     ConfirmPasswordForm
 )
 
+from app.utils import is_gov_user
+
 from app import user_api_client
 
 NEW_EMAIL = 'new-email'
@@ -31,7 +34,10 @@ NEW_MOBILE_PASSWORD_CONFIRMED = 'new-mob-password-confirmed'
 @main.route("/user-profile")
 @login_required
 def user_profile():
-    return render_template('views/user-profile.html')
+    return render_template(
+        'views/user-profile.html',
+        can_see_edit=is_gov_user(current_user.email_address)
+    )
 
 
 @main.route("/user-profile/name", methods=['GET', 'POST'])
@@ -56,6 +62,9 @@ def user_profile_name():
 @login_required
 def user_profile_email():
 
+    if not is_gov_user(current_user.email_address):
+        abort(403)
+
     def _is_email_unique(email):
         return user_api_client.is_email_unique(email)
     form = ChangeEmailForm(_is_email_unique,