From caad00df188983273e8628d7e677e0e162cf1720 Mon Sep 17 00:00:00 2001
From: Erin Song <121973038+erinysong@users.noreply.github.com>
Date: Thu, 26 Sep 2024 10:24:29 -0700
Subject: [PATCH 01/46] Block users invited to other orgs from being domain
managers
---
src/registrar/views/domain.py | 56 +++++++++++++++++++++++++++--------
1 file changed, 43 insertions(+), 13 deletions(-)
diff --git a/src/registrar/views/domain.py b/src/registrar/views/domain.py
index db0572bb3..dae3b60cd 100644
--- a/src/registrar/views/domain.py
+++ b/src/registrar/views/domain.py
@@ -21,8 +21,10 @@
DomainRequest,
DomainInformation,
DomainInvitation,
+ PortfolioInvitation,
User,
UserDomainRole,
+ UserPortfolioPermission,
PublicContact,
)
from registrar.utility.enums import DefaultEmail
@@ -38,6 +40,7 @@
)
from registrar.models.utility.contact_error import ContactError
from registrar.views.utility.permission_views import UserDomainRolePermissionDeleteView
+from registrar.utility.waffle import flag_is_active_for_user
from ..forms import (
SeniorOfficialContactForm,
@@ -778,7 +781,14 @@ def _domain_abs_url(self):
"""Get an absolute URL for this domain."""
return self.request.build_absolute_uri(reverse("domain", kwargs={"pk": self.object.id}))
- def _send_domain_invitation_email(self, email: str, requestor: User, add_success=True):
+ def _is_member_of_different_org(self, email, org):
+ """Verifies if an email belongs to a different organization as a member or invited member."""
+ # Check if user is a member of a different organization
+ existing_org_permission = UserPortfolioPermission.objects.get(email=email)
+ print("Existing org permission: ", existing_org_permission)
+ return True
+
+ def _send_domain_invitation_email(self, email: str, requestor: User, requested_user=None, add_success=True):
"""Performs the sending of the domain invitation email,
does not make a domain information object
email: string- email to send to
@@ -803,6 +813,26 @@ def _send_domain_invitation_email(self, email: str, requestor: User, add_success
)
return None
+ # Check is user is a member or invited member of a different org from this domain's org
+ print("org feature flag is active: ", flag_is_active_for_user(requestor, "organization_feature"))
+ if flag_is_active_for_user(requestor, "organization_feature"):
+ # Check if invited user is a member from a different org from this domain's org
+ existing_org_permission = UserPortfolioPermission.objects.filter(user=requested_user).first()
+ print("Existing org permission for requested email: ", existing_org_permission)
+
+ existing_org_invitation = PortfolioInvitation.objects.filter(email=email).first()
+ requestor_org = UserPortfolioPermission.objects.get(user=requestor).portfolio
+ print("Requestor org: ", requestor_org)
+ if (existing_org_permission and existing_org_permission.portfolio != requestor_org) or \
+ (existing_org_invitation and existing_org_invitation.portfolio != requestor_org):
+ add_success=False
+ messages.error(
+ self.request,
+ f"That email is already a member of another .gov organization.",
+ )
+ raise Exception
+
+
# Check to see if an invite has already been sent
try:
invite = DomainInvitation.objects.get(email=email, domain=self.object)
@@ -868,7 +898,7 @@ def form_valid(self, form):
else:
# if user already exists then just send an email
try:
- self._send_domain_invitation_email(requested_email, requestor, add_success=False)
+ self._send_domain_invitation_email(requested_email, requestor, requested_user=requested_user, add_success=False)
except EmailSendingError:
logger.warn(
"Could not send email invitation (EmailSendingError)",
@@ -883,17 +913,17 @@ def form_valid(self, form):
exc_info=True,
)
messages.warning(self.request, "Could not send email invitation.")
-
- try:
- UserDomainRole.objects.create(
- user=requested_user,
- domain=self.object,
- role=UserDomainRole.Roles.MANAGER,
- )
- except IntegrityError:
- messages.warning(self.request, f"{requested_email} is already a manager for this domain")
- else:
- messages.success(self.request, f"Added user {requested_email}.")
+ else:
+ try:
+ UserDomainRole.objects.create(
+ user=requested_user,
+ domain=self.object,
+ role=UserDomainRole.Roles.MANAGER,
+ )
+ except IntegrityError:
+ messages.warning(self.request, f"{requested_email} is already a manager for this domain")
+ else:
+ messages.success(self.request, f"Added user {requested_email}.")
return redirect(self.get_success_url())
From 42de7f2bb79e76b9efcb242da853ed036c3959bc Mon Sep 17 00:00:00 2001
From: Erin Song <121973038+erinysong@users.noreply.github.com>
Date: Thu, 26 Sep 2024 10:40:36 -0700
Subject: [PATCH 02/46] Add domain manager breadcrumb nav
---
src/registrar/templates/domain_add_user.html | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/src/registrar/templates/domain_add_user.html b/src/registrar/templates/domain_add_user.html
index b2f9fef24..320404fa9 100644
--- a/src/registrar/templates/domain_add_user.html
+++ b/src/registrar/templates/domain_add_user.html
@@ -4,6 +4,19 @@
{% block title %}Add a domain manager | {% endblock %}
{% block domain_content %}
+ {% block breadcrumb %}
+ {% url 'domain-users' pk=domain.id as url %}
+
+ {% endblock breadcrumb %}
Add a domain manager
You can add another user to help manage your domain. They will need to sign
From 8b61eb1275f2d340c458898d22baccb1a7c53b4a Mon Sep 17 00:00:00 2001
From: Erin Song <121973038+erinysong@users.noreply.github.com>
Date: Thu, 26 Sep 2024 10:43:32 -0700
Subject: [PATCH 03/46] Update add domain manager page content
---
src/registrar/templates/domain_add_user.html | 4 ++--
src/registrar/views/domain.py | 12 +++++++-----
2 files changed, 9 insertions(+), 7 deletions(-)
diff --git a/src/registrar/templates/domain_add_user.html b/src/registrar/templates/domain_add_user.html
index 320404fa9..e95bacd76 100644
--- a/src/registrar/templates/domain_add_user.html
+++ b/src/registrar/templates/domain_add_user.html
@@ -19,8 +19,8 @@
{% endblock breadcrumb %}
Add a domain manager
-
You can add another user to help manage your domain. They will need to sign
- in to the .gov registrar with their Login.gov account.
+
You can add another user to help manage your domain. If they aren't an organization member they will
+ need to sign in to the .gov registrar with their Login.gov account.