Wrap permissions around team change on edit user form

uktrade · Feb 7, 2024 · 11a6a66 · 11a6a66
1 parent 33acdc8
commit 11a6a66
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 7 deletions.
diff --git a/caseworker/users/forms/users.py b/caseworker/users/forms/users.py
@@ -37,16 +37,19 @@ def add_user_form(request):
     )
 
 
-def edit_user_form(request, user, can_edit_role: bool):
+def edit_user_form(request, user, can_edit_role: bool, can_edit_team: bool):
     return Form(
         title=EditUserForm.TITLE.format(user["first_name"], user["last_name"]),
         questions=[
             TextInput(title=EditUserForm.Email.TITLE, description=EditUserForm.Email.DESCRIPTION, name="email"),
-            Select(
-                title=EditUserForm.Team.TITLE,
-                description=EditUserForm.Team.DESCRIPTION,
-                name="team",
-                options=get_teams(request, True),
+            conditional(
+                can_edit_team,
+                Select(
+                    title=EditUserForm.Team.TITLE,
+                    description=EditUserForm.Team.DESCRIPTION,
+                    name="team",
+                    options=get_teams(request, True),
+                ),
             ),
             conditional(
                 can_edit_role,

diff --git a/caseworker/users/views/users.py b/caseworker/users/views/users.py
@@ -104,9 +104,11 @@ class EditUser(SingleFormView):
     def init(self, request, **kwargs):
         self.object_pk = kwargs["pk"]
         user, _ = get_gov_user(request, self.object_pk)
+        request_user, _ = get_gov_user(request, str(request.session["lite_api_user_id"]))
         self.user = user["user"]
         can_edit_role = self.user["id"] != request.session["lite_api_user_id"]
-        self.form = edit_user_form(request, self.user, can_edit_role)
+        can_edit_team = is_super_user(request_user) or is_user_in_team(request_user, ADMIN_TEAM_ID)
+        self.form = edit_user_form(request, self.user, can_edit_role, can_edit_team)
         self.data = self.user
         self.action = put_gov_user
         self.success_url = reverse("users:user", kwargs={"pk": self.object_pk})