mirror of
https://github.com/GSA/notifications-api.git
synced 2026-08-23 15:56:45 -04:00
Set count as live to false for broadcast services
We think it would be a security risk to show the name of services involved in emergency alerts as they be responsible for things such as counter terrorism. On top of that, showing broadcast services in the list of all services could enable someone to use that information to try and trick an admin into letting them access of a particular service given the fact they know the name of it
This commit is contained in:
@@ -1092,10 +1092,11 @@ def create_contact_list(service_id):
|
|||||||
@service_blueprint.route('/<uuid:service_id>/set-as-broadcast-service', methods=['POST'])
|
@service_blueprint.route('/<uuid:service_id>/set-as-broadcast-service', methods=['POST'])
|
||||||
def set_as_broadcast_service(service_id):
|
def set_as_broadcast_service(service_id):
|
||||||
"""
|
"""
|
||||||
This route does three things
|
This route does four things
|
||||||
- adds a service broadcast settings to define which channel broadcasts should go out on
|
- adds a service broadcast settings to define which channel broadcasts should go out on
|
||||||
- removes all current service permissions
|
- removes all current service permissions
|
||||||
- adds the broadcast service permission
|
- adds the broadcast service permission
|
||||||
|
- sets the services `count_as_live` to false
|
||||||
"""
|
"""
|
||||||
data = validate(request.get_json(), service_broadcast_settings_schema)
|
data = validate(request.get_json(), service_broadcast_settings_schema)
|
||||||
service = dao_fetch_service_by_id(service_id)
|
service = dao_fetch_service_by_id(service_id)
|
||||||
@@ -1107,5 +1108,8 @@ def set_as_broadcast_service(service_id):
|
|||||||
dao_remove_service_permission(service.id, permission.permission)
|
dao_remove_service_permission(service.id, permission.permission)
|
||||||
dao_add_service_permission(service.id, BROADCAST_TYPE)
|
dao_add_service_permission(service.id, BROADCAST_TYPE)
|
||||||
|
|
||||||
|
service.count_as_live = False
|
||||||
|
dao_update_service(service)
|
||||||
|
|
||||||
data = service_schema.dump(service).data
|
data = service_schema.dump(service).data
|
||||||
return jsonify(data=data)
|
return jsonify(data=data)
|
||||||
|
|||||||
@@ -162,7 +162,8 @@ def sample_broadcast_service(notify_db_session):
|
|||||||
'restricted': False,
|
'restricted': False,
|
||||||
'email_from': email_from,
|
'email_from': email_from,
|
||||||
'created_by': user,
|
'created_by': user,
|
||||||
'crown': True
|
'crown': True,
|
||||||
|
'count_as_live': False,
|
||||||
}
|
}
|
||||||
service = Service.query.filter_by(name=service_name).first()
|
service = Service.query.filter_by(name=service_name).first()
|
||||||
if not service:
|
if not service:
|
||||||
|
|||||||
@@ -3759,3 +3759,21 @@ def test_set_as_broadcast_service_maintains_broadcast_permission_for_existing_br
|
|||||||
|
|
||||||
permissions = ServicePermission.query.filter_by(service_id=sample_broadcast_service.id).all()
|
permissions = ServicePermission.query.filter_by(service_id=sample_broadcast_service.id).all()
|
||||||
assert [p.permission for p in permissions] == [BROADCAST_TYPE]
|
assert [p.permission for p in permissions] == [BROADCAST_TYPE]
|
||||||
|
|
||||||
|
|
||||||
|
def test_set_as_broadcast_service_sets_count_as_live_to_false(client, notify_db, sample_service):
|
||||||
|
assert sample_service.count_as_live == True
|
||||||
|
|
||||||
|
resp = client.post(
|
||||||
|
'/service/{}/set-as-broadcast-service'.format(sample_service.id),
|
||||||
|
data=json.dumps({
|
||||||
|
'broadcast_channel': "severe",
|
||||||
|
}),
|
||||||
|
headers=[('Content-Type', 'application/json'), create_authorization_header()]
|
||||||
|
)
|
||||||
|
result = resp.json
|
||||||
|
assert resp.status_code == 200
|
||||||
|
assert result['data']['count_as_live'] == False
|
||||||
|
|
||||||
|
service_from_db = Service.query.filter_by(id=sample_service.id).all()[0]
|
||||||
|
assert service_from_db.count_as_live == False
|
||||||
|
|||||||
Reference in New Issue
Block a user