Allow setting of caseworking on a user

This commit changes the form that the user sees when inviting or editing
another user, if the service has the ‘caseworking’ permission set.

This will allow creating a new type of user, one who only has the
`send_messages` permission, without the `view_activity` permission.

We are doing this because we think there are a number of services with a
lot of users who don’t need to see the dashboard, or the other team
members, and that we can make a simpler interface for these users.

app/main/forms.py

@@ -287,6 +287,28 @@ class AdminPermissionsForm(AbstractPermissionsForm):
         self.view_activity.data = True
 
 
+class CaseworkingPermissionsForm(AbstractPermissionsForm):
+
+    def process(self, *args, **kwargs):
+        super().process(*args, **kwargs)
+        if self.user_type.data == 'admin':
+            self.view_activity.data = True
+        elif self.user_type.data == 'caseworker':
+            self.view_activity.data = False
+            self.manage_templates.data = False
+            self.manage_service.data = False
+            self.manage_api_keys.data = False
+            self.send_messages.data = True
+
+    user_type = RadioField(
+        'User type',
+        choices=[
+            ('caseworker', 'Caseworker'),
+            ('admin', 'Admin'),
+        ],
+    )
+
+
 class AbstractInviteUserForm(StripWhitespaceForm):
     email_address = email_address(gov_user=False)
 
@@ -303,6 +325,10 @@ class AdminInviteUserForm(AbstractInviteUserForm, AdminPermissionsForm):
     pass
 
 
+class CaseworkingInviteUserForm(AbstractInviteUserForm, CaseworkingPermissionsForm):
+    pass
+
+
 class InviteOrgUserForm(StripWhitespaceForm):
     email_address = email_address(gov_user=False)
 

app/main/views/manage_users.py

@@ -1,3 +1,5 @@
+from functools import partial
+
 from flask import abort, flash, redirect, render_template, request, url_for
 from flask_login import current_user, login_required
 from notifications_python_client.errors import HTTPError
@@ -12,6 +14,8 @@ from app.main import main
 from app.main.forms import (
     AdminInviteUserForm,
     AdminPermissionsForm,
+    CaseworkingInviteUserForm,
+    CaseworkingPermissionsForm,
     SearchUsersForm,
 )
 from app.notify_client.models import roles
@@ -44,9 +48,12 @@ def manage_users(service_id):
 @user_has_permissions('manage_service')
 def invite_user(service_id):
 
-    form = AdminInviteUserForm(
-        invalid_email_address=current_user.email_address
-    )
+    if 'caseworking' in current_service['permissions']:
+        form = CaseworkingInviteUserForm
+    else:
+        form = AdminInviteUserForm
+
+    form = form(invalid_email_address=current_user.email_address)
 
     service_has_email_auth = 'email_auth' in current_service['permissions']
     if not service_has_email_auth:
@@ -82,10 +89,19 @@ def edit_user_permissions(service_id, user_id):
     user = user_api_client.get_user(user_id)
     user_has_no_mobile_number = user.mobile_number is None
 
-    form = AdminPermissionsForm(
+    if 'caseworking' in current_service['permissions']:
+        form = partial(
+            CaseworkingPermissionsForm,
+            user_type='admin' if user.has_permission_for_service(service_id, 'view_activity') else 'caseworker',
+        )
+    else:
+        form = AdminPermissionsForm
+
+    form = form(
         **{role: user.has_permission_for_service(service_id, role) for role in roles.keys()},
         login_authentication=user.auth_type
     )
+
     if form.validate_on_submit():
         user_api_client.set_user_permissions(
             user_id, service_id,