Merge pull request #358 from alphagov/fix-permissions

Add view_activity permissions

app/main/views/choose_service.py

@@ -10,14 +10,15 @@ from app.notify_client.api_client import ServicesBrowsableItem
 def choose_service():
     return render_template(
         'views/choose-service.html',
-        services=[ServicesBrowsableItem(x) for x in service_api_client.get_services()['data']]
+        services=[ServicesBrowsableItem(x) for x in
+                  service_api_client.get_services({'user_id': current_user.id})['data']]
     )
 
 
 @main.route("/services-or-dashboard")
 @login_required
 def show_all_services_or_dashboard():
-    services = service_api_client.get_services()['data']
+    services = service_api_client.get_services({'user_id': current_user.id})['data']
 
     if 1 == len(services):
         return redirect(url_for('.service_dashboard', service_id=services[0]['id']))

app/main/views/dashboard.py

@@ -13,7 +13,7 @@ from app.utils import user_has_permissions
 
 @main.route("/services/<service_id>/dashboard")
 @login_required
-@user_has_permissions()
+@user_has_permissions('view_activity', admin_override=True)
 def service_dashboard(service_id):
     templates = service_api_client.get_service_templates(service_id)['data']
     jobs = job_api_client.get_job(service_id)['data']

app/main/views/jobs.py

@@ -6,10 +6,7 @@ from flask import (
     render_template,
     abort,
     jsonify,
-    flash,
-    redirect,
-    request,
-    url_for
+    request
 )
 from flask_login import login_required
 from utils.template import Template
@@ -24,7 +21,7 @@ from app.utils import (
 
 @main.route("/services/<service_id>/jobs")
 @login_required
-@user_has_permissions()
+@user_has_permissions('view_activity', admin_override=True)
 def view_jobs(service_id):
     jobs = job_api_client.get_job(service_id)['data']
     return render_template(
@@ -36,7 +33,7 @@ def view_jobs(service_id):
 
 @main.route("/services/<service_id>/jobs/<job_id>")
 @login_required
-@user_has_permissions()
+@user_has_permissions('view_activity', admin_override=True)
 def view_job(service_id, job_id):
     service = service_api_client.get_service(service_id)['data']
     job = job_api_client.get_job(service_id, job_id)['data']
@@ -65,7 +62,7 @@ def view_job(service_id, job_id):
 
 @main.route("/services/<service_id>/jobs/<job_id>.json")
 @login_required
-@user_has_permissions()
+@user_has_permissions('view_activity')
 def view_job_updates(service_id, job_id):
     service = service_api_client.get_service(service_id)['data']
     job = job_api_client.get_job(service_id, job_id)['data']
@@ -93,7 +90,7 @@ def view_job_updates(service_id, job_id):
 
 @main.route('/services/<service_id>/notifications')
 @login_required
-@user_has_permissions()
+@user_has_permissions('view_activity', admin_override=True)
 def view_notifications(service_id):
     # TODO get the api to return count of pages as well.
     page = get_page_from_request()
@@ -122,7 +119,7 @@ def view_notifications(service_id):
 
 @main.route("/services/<service_id>/jobs/<job_id>/notification/<string:notification_id>")
 @login_required
-@user_has_permissions()
+@user_has_permissions('view_activity', admin_override=True)
 def view_notification(service_id, job_id, notification_id):
 
     now = time.strftime('%H:%M')

app/main/views/manage_users.py

@@ -27,13 +27,13 @@ from app.utils import user_has_permissions
 roles = {
     'send_messages': ['send_texts', 'send_emails', 'send_letters'],
     'manage_service': ['manage_users', 'manage_templates', 'manage_settings'],
-    'manage_api_keys': ['manage_api_keys', 'access_developer_docs']
+    'manage_api_keys': ['manage_api_keys']
 }
 
 
 @main.route("/services/<service_id>/users")
 @login_required
-@user_has_permissions()
+@user_has_permissions('view_activity', admin_override=True)
 def manage_users(service_id):
     return render_template(
         'views/manage-users.html',
@@ -57,13 +57,15 @@ def invite_user(service_id):
 
     if form.validate_on_submit():
         email_address = form.email_address.data
+        # view_activity is a default role to be added to all users.
+        # All users will have at minimum view_activity to allow users to see notifications,
+        # templates, team members but no update privileges
+        permissions = ','.join(role for role in roles.keys() if request.form.get(role) == 'y').join('view_activity')
         invited_user = invite_api_client.create_invite(
             current_user.id,
             service_id,
             email_address,
-            ','.join(
-                role for role in roles.keys() if request.form.get(role) == 'y'
-            )
+            permissions
         )
 
         flash('Invite sent to {}'.format(invited_user.email_address), 'default_with_tick')
@@ -95,7 +97,7 @@ def edit_user_permissions(service_id, user_id):
             user_id, service_id,
             permissions=set(chain.from_iterable(
                 permissions for role, permissions in roles.items() if form[role].data
-            ))
+            )) | {'view_activity'}
         )
         return redirect(url_for('.manage_users', service_id=service_id))
 

app/main/views/send.py

@@ -64,8 +64,12 @@ def get_page_headings(template_type):
 
 @main.route("/services/<service_id>/send/<template_type>", methods=['GET'])
 @login_required
-@user_has_permissions('send_texts', 'send_emails', 'send_letters', 'manage_templates', 'manage_api_keys',
-                      admin_override=True, or_=True)
+@user_has_permissions('view_activity',
+                      'send_texts',
+                      'send_emails',
+                      'manage_templates',
+                      'manage_api_keys',
+                      admin_override=True, any_=True)
 def choose_template(service_id, template_type):
 
     service = service_api_client.get_service(service_id)['data']
@@ -140,7 +144,7 @@ def send_messages(service_id, template_id):
 
 @main.route("/services/<service_id>/send/<template_id>.csv", methods=['GET'])
 @login_required
-@user_has_permissions('send_texts', 'send_emails', 'send_letters', 'manage_templates', or_=True)
+@user_has_permissions('send_texts', 'send_emails', 'send_letters', 'manage_templates', any_=True)
 def get_example_csv(service_id, template_id):
     template = Template(service_api_client.get_service_template(service_id, template_id)['data'])
     # Good practice to use context managers
@@ -203,7 +207,7 @@ def send_message_to_self(service_id, template_id):
 
 @main.route("/services/<service_id>/send/<template_id>/from-api", methods=['GET'])
 @login_required
-@user_has_permissions('manage_api_keys', 'access_developer_docs')
+@user_has_permissions('manage_api_keys')
 def send_from_api(service_id, template_id):
     template = Template(
         service_api_client.get_service_template(service_id, template_id)['data']