Add READ_IMAGES permission

Author: swebberuk

manage_breast_screening/auth/models.py

@@ -12,3 +12,4 @@ class Permission(StrEnum):
     VIEW_MAMMOGRAM_APPOINTMENT = "mammograms.view_mammogram_appointment"
     DO_MAMMOGRAM_APPOINTMENT = "mammograms.do_mammogram_appointment"
     MANAGE_PROVIDER_SETTINGS = "clinics.manage_provider_settings"
+    READ_IMAGES = "reading.read_images"

manage_breast_screening/auth/rules.py

@@ -30,4 +30,5 @@ def is_superuser(user):
 
 
 rules.add_perm(Permission.VIEW_PARTICIPANT_DATA, is_clinical | is_administrative)
+rules.add_perm(Permission.READ_IMAGES, is_reader)
 rules.add_perm(Permission.MANAGE_PROVIDER_SETTINGS, is_superuser)

manage_breast_screening/auth/tests/test_rules.py

@@ -103,6 +103,12 @@ def test_returns_true_for_administrative_user(self):
 
         assert user_assignment.user.has_perm(Permission.VIEW_PARTICIPANT_DATA)
 
+    def test_returns_false_for_reader(self):
+        user_assignment = UserAssignmentFactory.create(reader=True)
+        user_assignment.make_current()
+
+        assert not user_assignment.user.has_perm(Permission.VIEW_PARTICIPANT_DATA)
+
     def test_returns_false_for_user_without_roles(self):
         user_assignment = UserAssignmentFactory.create()
         user_assignment.make_current()
@@ -115,6 +121,38 @@ def test_returns_false_if_no_provider_given(self):
         assert not user_assignment.user.has_perm(Permission.VIEW_PARTICIPANT_DATA)
 
 
+@pytest.mark.django_db
+class TestReadImagesPermission:
+    def test_returns_true_for_reader(self):
+        user_assignment = UserAssignmentFactory.create(reader=True)
+        user_assignment.make_current()
+
+        assert user_assignment.user.has_perm(Permission.READ_IMAGES)
+
+    def test_returns_false_for_clinical_user(self):
+        user_assignment = UserAssignmentFactory.create(clinical=True)
+        user_assignment.make_current()
+
+        assert not user_assignment.user.has_perm(Permission.READ_IMAGES)
+
+    def test_returns_false_for_administrative_user(self):
+        user_assignment = UserAssignmentFactory.create(administrative=True)
+        user_assignment.make_current()
+
+        assert not user_assignment.user.has_perm(Permission.READ_IMAGES)
+
+    def test_returns_false_for_user_without_roles(self):
+        user_assignment = UserAssignmentFactory.create()
+        user_assignment.make_current()
+
+        assert not user_assignment.user.has_perm(Permission.READ_IMAGES)
+
+    def test_returns_false_if_no_provider_given(self):
+        user_assignment = UserAssignmentFactory.create()
+
+        assert not user_assignment.user.has_perm(Permission.READ_IMAGES)
+
+
 @pytest.mark.django_db
 class TestIsSysadmin:
     def test_returns_true_for_sysadmin_user(self):

manage_breast_screening/reading/views.py

@@ -1,3 +1,4 @@
+from django.contrib.auth.decorators import permission_required
 from django.forms import Form
 from django.shortcuts import render
 from django.views.decorators.http import require_http_methods
@@ -12,14 +13,15 @@
 
 
 @require_http_methods(["GET"])
+@permission_required(Permission.READ_IMAGES, raise_exception=True)
 def show_reading_dashboard_view(request):
     return render(request, "show_readings.jinja")
 
 
 class ReadImageView(PermissionRequiredMixin, AppointmentMixin, FormView):
     form_class = Form
     template_name = "read_image.jinja"
-    permission_required = Permission.VIEW_MAMMOGRAM_APPOINTMENT
+    permission_required = Permission.READ_IMAGES
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)