[UK Councils] Council users can only see their own council's admin

2 files changed, 50 insertions, 9 deletions

diff --git a/perllib/FixMyStreet/Cobrand/UKCouncils.pm b/perllib/FixMyStreet/Cobrand/UKCouncils.pm
index 6e98f4ae0..43f10130a 100644
--- a/perllib/FixMyStreet/Cobrand/UKCouncils.pm
+++ b/perllib/FixMyStreet/Cobrand/UKCouncils.pm
@@ -150,4 +150,11 @@ sub base_url_for_report {
     }
 }
 
+sub admin_allow_user {
+    my ( $self, $user ) = @_;
+    return 1 if $user->is_superuser;
+    return undef unless defined $user->from_body;
+    return $user->from_body->id == $self->council_id;
+}
+
 1;
diff --git a/t/app/controller/admin.t b/t/app/controller/admin.t
index 9b083ce42..0f6f9744c 100644
--- a/t/app/controller/admin.t
+++ b/t/app/controller/admin.t
@@ -23,10 +23,10 @@ my $superuser =
 ok $superuser, "created superuser";
 
 my $oxfordshire = $mech->create_body_ok(2237, 'Oxfordshire County Council', id => 2237 );
-my $counciluser =
+my $oxfordshireuser =
   FixMyStreet::App->model('DB::User')
-  ->find_or_create( { email => 'counciluser@example.com', name => 'Council User', from_body => $oxfordshire->id } );
-ok $counciluser, "created council user";
+  ->find_or_create( { email => 'counciluser@example.com', name => 'Council User', from_body => $oxfordshire } );
+ok $oxfordshireuser, "created council user";
 
 
 my $user3 =
@@ -1304,13 +1304,47 @@ subtest "Users without from_body can't access admin" => sub {
     $mech->log_out_ok;
 };
 
-subtest "Users with from_body can access admin" => sub {
-    $mech->log_in_ok( $counciluser->email );
+subtest "Users with from_body can access their own council's admin" => sub {
+    FixMyStreet::override_config {
+        ALLOWED_COBRANDS => [ 'oxfordshire' ],
+    }, sub {
+        $mech->log_in_ok( $oxfordshireuser->email );
 
-    $mech->get_ok('/admin');
-    $mech->content_contains( 'FixMyStreet admin:' );
+        $mech->get_ok('/admin');
+        $mech->content_contains( 'FixMyStreet admin:' );
 
-    $mech->log_out_ok;
+        $mech->log_out_ok;
+    };
+};
+
+subtest "Users with from_body can't access another council's admin" => sub {
+    FixMyStreet::override_config {
+        ALLOWED_COBRANDS => [ 'bristol' ],
+    }, sub {
+        $mech->log_in_ok( $oxfordshireuser->email );
+
+        $mech->get_ok('/admin');
+        is $mech->uri->path, '/my', "redirected to correct page";
+        is $mech->res->code, 200, "got 200 for final destination";
+        is $mech->res->previous->code, 302, "got 302 for redirect";
+
+        $mech->log_out_ok;
+    };
+};
+
+subtest "Users with from_body can't access fixmystreet.com admin" => sub {
+    FixMyStreet::override_config {
+        ALLOWED_COBRANDS => [ 'fixmystreet' ],
+    }, sub {
+        $mech->log_in_ok( $oxfordshireuser->email );
+
+        $mech->get_ok('/admin');
+        is $mech->uri->path, '/my', "redirected to correct page";
+        is $mech->res->code, 200, "got 200 for final destination";
+        is $mech->res->previous->code, 302, "got 302 for redirect";
+
+        $mech->log_out_ok;
+    };
 };
 
 
@@ -1319,7 +1353,7 @@ $mech->delete_user( $user );
 $mech->delete_user( $user2 );
 $mech->delete_user( $user3 );
 $mech->delete_user( $superuser );
-$mech->delete_user( $counciluser );
+$mech->delete_user( $oxfordshireuser );
 $mech->delete_user( 'test4@example.com' );
 
 done_testing();