mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-05-03 23:51:22 -04:00
a84705f834
We've added new broadcast roles in the database (`create_broadcasts` and `approve_broadcasts`). Adding these has meant we've needed to do a bit of a rewrite of the roles and permissions code since this had been based on the assumption that each database permission only belongs to one admin role - this is no longer true. This means that flipping the roles dict round to create a dict which contains database permissions as the keys is no longer possible. We can't necessarily tell which admin role someone has given a database permission. To check if a user has an admin role given a list of database permissions, the user must now have ALL the database permissions mapped to that role (instead of just one). This works because no one has the `manage_users` permission without also having the `manage_settings` (and similar for the other admin roles which map to multiple database permissions). Some test data was changed because it was using admin roles where database permissions are actually used when the app is running. I've kept the functionality of the `translate_permissions_from_db_to_admin_roles` function passing through any unknown roles it is passed as an argument. This is not necessary, so can be changed later if we decide it will not ever be used. However, removing it would require updating a lot of tests since the tests rely on this behaviour.
52 lines
1.9 KiB
Python
52 lines
1.9 KiB
Python
from itertools import chain
|
|
|
|
roles = {
|
|
'send_messages': ['send_texts', 'send_emails', 'send_letters'],
|
|
'manage_templates': ['manage_templates'],
|
|
'manage_service': ['manage_users', 'manage_settings'],
|
|
'manage_api_keys': ['manage_api_keys'],
|
|
'view_activity': ['view_activity'],
|
|
'create_broadcasts': ['manage_templates', 'create_broadcasts', 'reject_broadcasts', 'cancel_broadcasts'],
|
|
'approve_broadcasts': ['approve_broadcasts', 'reject_broadcasts', 'cancel_broadcasts'],
|
|
}
|
|
|
|
all_permissions = set(roles.keys())
|
|
all_database_permissions = set(chain(*roles.values()))
|
|
|
|
permissions = (
|
|
('view_activity', 'See dashboard'),
|
|
('send_messages', 'Send messages'),
|
|
('manage_templates', 'Add and edit templates'),
|
|
('manage_service', 'Manage settings, team and usage'),
|
|
('manage_api_keys', 'Manage API integration'),
|
|
)
|
|
|
|
broadcast_permissions = (
|
|
('create_broadcasts', 'Add new alerts and templates'),
|
|
('approve_broadcasts', 'Approve alerts'),
|
|
)
|
|
|
|
|
|
def translate_permissions_from_db_to_admin_roles(permissions):
|
|
"""
|
|
Given a list of database permissions, return a set of roles
|
|
|
|
A role is returned if all of its database permissions are in the permission list that is passed in.
|
|
Any permissions in the list that are not database permissions are also returned.
|
|
"""
|
|
unknown_database_permissions = {p for p in permissions if p not in all_database_permissions}
|
|
|
|
return {
|
|
admin_role for admin_role, db_role_list in roles.items()
|
|
if set(db_role_list) <= set(permissions)
|
|
} | unknown_database_permissions
|
|
|
|
|
|
def translate_permissions_from_admin_roles_to_db(permissions):
|
|
"""
|
|
Given a list of admin roles (ie: checkboxes on a permissions edit page for example), return a set of db permissions
|
|
|
|
Looks them up in the roles dict, falling back to just passing through if they're not recognised.
|
|
"""
|
|
return set(chain.from_iterable(roles.get(permission, [permission]) for permission in permissions))
|