Add assigned_(users|categories)_only functionality

Users with assigned_categories_only will only see staff features on a
report page in their assigned categories.

Users will only see staff features on a report page in a category with
assigned_users_only if it is in their assigned categories.

12 files changed, 118 insertions, 9 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c19e2ffa3..2b429624e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,7 @@
         - Interface for disabling updates/reopening for certain categories. #2991 #2992
         - Include group in CSV export if enabled. #2994
         - In category admin, group already shown elsewhere.
+        - Add assigned_(users|categories)_only functionality.
     - Bugfixes:
         - Application user in Docker container can't install packages. #2914
         - Look at all categories when sending reports.
diff --git a/docs/assets/img/pro-user-guide/edit-category-page.png b/docs/assets/img/pro-user-guide/edit-category-page.png
index 8b029faa0..db84bbb70 100644..100755
--- a/docs/assets/img/pro-user-guide/edit-category-page.png
+++ b/docs/assets/img/pro-user-guide/edit-category-page.png
diff --git a/perllib/FixMyStreet/App/Controller/Admin/Bodies.pm b/perllib/FixMyStreet/App/Controller/Admin/Bodies.pm
index bfa74ad4e..07d058872 100644
--- a/perllib/FixMyStreet/App/Controller/Admin/Bodies.pm
+++ b/perllib/FixMyStreet/App/Controller/Admin/Bodies.pm
@@ -267,7 +267,7 @@ sub update_contact : Private {
     $contact->send_method( $c->get_param('send_method') );
 
     # Set flags in extra to the appropriate values
-    foreach (qw(photo_required open311_protect updates_disallowed reopening_disallowed)) {
+    foreach (qw(photo_required open311_protect updates_disallowed reopening_disallowed assigned_users_only)) {
         if ( $c->get_param($_) ) {
             $contact->set_extra_metadata( $_ => 1 );
         } else {
diff --git a/perllib/FixMyStreet/App/Controller/Admin/Users.pm b/perllib/FixMyStreet/App/Controller/Admin/Users.pm
index 046e19126..f4b9bd7dc 100644
--- a/perllib/FixMyStreet/App/Controller/Admin/Users.pm
+++ b/perllib/FixMyStreet/App/Controller/Admin/Users.pm
@@ -373,6 +373,11 @@ sub edit : Chained('user') : PathPart('') : Args(0) {
             my @live_contact_ids = map { $_->id } @live_contacts;
             my @new_contact_ids = grep { $c->get_param("contacts[$_]") } @live_contact_ids;
             $user->set_extra_metadata('categories', \@new_contact_ids);
+            if ($c->get_param('assigned_categories_only')) {
+                $user->set_extra_metadata(assigned_categories_only => 1);
+            } else {
+                $user->unset_extra_metadata('assigned_categories_only');
+            }
         } else {
             $user->unset_extra_metadata('categories');
         }
diff --git a/perllib/FixMyStreet/App/Controller/Report.pm b/perllib/FixMyStreet/App/Controller/Report.pm
index 82e8b107f..3052b1015 100644
--- a/perllib/FixMyStreet/App/Controller/Report.pm
+++ b/perllib/FixMyStreet/App/Controller/Report.pm
@@ -87,6 +87,24 @@ sub display :PathPart('') :Chained('id') :Args(0) {
 
     my $permissions = $c->stash->{permissions} ||= $c->forward('fetch_permissions');
 
+    my $staff_user = $c->user_exists && ($c->user->is_superuser || $c->user->belongs_to_body($c->stash->{problem}->bodies_str));
+
+    if ($staff_user) {
+        # Check assigned categories feature
+        my $okay = 1;
+        my $contact = $c->stash->{problem}->contact;
+        if ($contact && ($c->user->get_extra_metadata('assigned_categories_only') || $contact->get_extra_metadata('assigned_users_only'))) {
+            my $user_cats = $c->user->get_extra_metadata('categories') || [];
+            $okay = any { $contact->id eq $_ } @$user_cats;
+        }
+        if ($okay) {
+            $c->stash->{relevant_staff_user} = 1;
+        } else {
+            # Remove all staff permissions
+            $permissions = $c->stash->{permissions} = {};
+        }
+    }
+
     if (grep { $permissions->{$_} } qw/report_inspect report_edit_category report_edit_priority report_mark_private triage/) {
         $c->stash->{template} = 'report/inspect.html';
         $c->forward('inspect');
diff --git a/t/app/controller/admin/bodies.t b/t/app/controller/admin/bodies.t
index d3e4074f9..883386380 100644
--- a/t/app/controller/admin/bodies.t
+++ b/t/app/controller/admin/bodies.t
@@ -261,6 +261,16 @@ subtest 'open311 protection editing' => sub {
     is $contact->get_extra_metadata('open311_protect'), 1, 'Open311 protect flag set';
 };
 
+subtest 'test assigned_users_only setting' => sub {
+    $mech->get_ok('/admin/body/' . $body->id . '/test%20category');
+    $mech->submit_form_ok( { with_fields => {
+        assigned_users_only => 1,
+    } } );
+    $mech->content_contains('Values updated');
+    my $contact = $body->contacts->find({ category => 'test category' });
+    is $contact->get_extra_metadata('assigned_users_only'), 1;
+};
+
 subtest 'updates disabling' => sub {
     $mech->get_ok('/admin/body/' . $body->id . '/test%20category');
     $mech->submit_form_ok( { with_fields => {
diff --git a/t/app/controller/admin/users.t b/t/app/controller/admin/users.t
index 4f0298103..bc8d28e2d 100644
--- a/t/app/controller/admin/users.t
+++ b/t/app/controller/admin/users.t
@@ -299,6 +299,7 @@ FixMyStreet::override_config {
                 flagged => undef,
                 is_superuser => undef,
                 area_ids => undef,
+                assigned_categories_only => undef,
                 %default_perms,
                 roles => $role->id,
             },
@@ -320,6 +321,7 @@ FixMyStreet::override_config {
                 flagged => undef,
                 is_superuser => undef,
                 area_ids => undef,
+                assigned_categories_only => undef,
                 %default_perms,
                 roles => $role->id,
             },
@@ -341,6 +343,7 @@ FixMyStreet::override_config {
                 flagged => undef,
                 is_superuser => undef,
                 area_ids => undef,
+                assigned_categories_only => undef,
                 %default_perms,
                 roles => $role->id,
             },
@@ -365,6 +368,7 @@ FixMyStreet::override_config {
                 flagged => undef,
                 is_superuser => undef,
                 area_ids => undef,
+                assigned_categories_only => undef,
                 %default_perms,
             },
             changes => {
@@ -385,6 +389,7 @@ FixMyStreet::override_config {
                 flagged => 'on',
                 is_superuser => undef,
                 area_ids => undef,
+                assigned_categories_only => undef,
                 %default_perms,
             },
             changes => {
@@ -394,7 +399,7 @@ FixMyStreet::override_config {
             log_entries => [qw/edit edit edit edit/],
         },
         {
-            desc => 'edit user add is_superuser',
+            desc => 'edit user add is_superuser and assigned_categories_only',
             fields => {
                 name => 'Changed User',
                 email => 'changed@example.com',
@@ -405,10 +410,12 @@ FixMyStreet::override_config {
                 flagged => undef,
                 is_superuser => undef,
                 area_ids => undef,
+                assigned_categories_only => undef,
                 %default_perms,
             },
             changes => {
                 is_superuser => 'on',
+                assigned_categories_only => 'on',
             },
             removed => [
                 keys %default_perms,
@@ -428,6 +435,7 @@ FixMyStreet::override_config {
                 flagged => undef,
                 is_superuser => 'on',
                 area_ids => undef,
+                assigned_categories_only => 'on',
             },
             changes => {
                 is_superuser => undef,
diff --git a/t/app/controller/report_inspect.t b/t/app/controller/report_inspect.t
index 8deb2667e..2852f8d18 100644
--- a/t/app/controller/report_inspect.t
+++ b/t/app/controller/report_inspect.t
@@ -822,7 +822,53 @@ FixMyStreet::override_config {
     };
 };
 
+FixMyStreet::override_config {
+    MAPIT_URL => 'http://mapit.uk/',
+    ALLOWED_COBRANDS => 'oxfordshire',
+}, sub {
+    subtest 'test relevant staff user display' => sub {
+        $user->user_body_permissions->create({ body => $oxon, permission_type => 'planned_reports' });
+        $user->user_body_permissions->create({ body => $oxon, permission_type => 'moderate' });
+        $mech->log_in_ok('body@example.com');
 
-END {
-    done_testing();
-}
+        # First, check user can see staff things on reports 2 and 3
+        $mech->get_ok("/report/$report2_id");
+        $mech->content_contains('<select class="form-control" name="state"  id="state">');
+        $mech->content_contains('<div class="inspect-section">');
+        $mech->get_ok("/report/$report3_id");
+        $mech->content_contains('<select class="form-control" name="state"  id="state">');
+        $mech->content_contains('<div class="inspect-section">');
+
+        # User's categories are ["Cows"], which is currently report 2
+        # So should be able to see staff things on 2, but no longer on 3
+        $user->set_extra_metadata(assigned_categories_only => 1);
+        $user->update;
+        $mech->get_ok("/report/$report2_id");
+        $mech->content_contains('<select class="form-control" name="state"  id="state">');
+        $mech->content_contains('<div class="inspect-section">');
+        $mech->get_ok("/report/$report3_id");
+        $mech->content_lacks('<select class="form-control" name="state"  id="state">');
+        $mech->content_lacks('<div class="inspect-section">');
+        $mech->content_lacks('Moderate this report');
+        $mech->content_lacks('shortlist');
+        $user->unset_extra_metadata('assigned_categories_only');
+        $user->update;
+
+        # Contact 2 is "Sheep", which is currently report 3
+        # So again, should be able to see staff things on 2, but no longer on 3
+        $contact2->set_extra_metadata(assigned_users_only => 1);
+        $contact2->update;
+        $mech->get_ok("/report/$report2_id");
+        $mech->content_contains('<select class="form-control" name="state"  id="state">');
+        $mech->content_contains('<div class="inspect-section">');
+        $mech->get_ok("/report/$report3_id");
+        $mech->content_lacks('<select class="form-control" name="state"  id="state">');
+        $mech->content_lacks('<div class="inspect-section">');
+        $mech->content_lacks('Moderate this report');
+        $mech->content_lacks('shortlist');
+        $contact2->unset_extra_metadata('assigned_users_only');
+        $contact2->update;
+    };
+};
+
+done_testing();
diff --git a/templates/web/base/admin/bodies/contact-form.html b/templates/web/base/admin/bodies/contact-form.html
index d989b62aa..85ed48fbf 100644
--- a/templates/web/base/admin/bodies/contact-form.html
+++ b/templates/web/base/admin/bodies/contact-form.html
@@ -81,6 +81,12 @@
       </p>
     [% END %]
 
+    <p class="form-check">
+        <input type="checkbox" name="assigned_users_only" value="1" id="assigned_users_only" [% ' checked' IF contact.extra.assigned_users_only %]>
+        <label for="assigned_users_only">[% loc('Frontend staff access only to users assigned to this category') %]</label>
+        <span class='form-hint'>[% loc('Use this if you wish only users assigned to this category to see staff-related features (such as the inspector form) in the front end.') %]</span>
+    </p>
+
   [% IF body.can_be_devolved %]
     <div class="admin-hint">
       <p>
@@ -125,7 +131,7 @@
     <h2>[% loc('Extra data:') %] </h2>
     <dl>
       [% FOR pair IN contact.get_extra_metadata %]
-        [% NEXT IF pair.key == 'group' %]
+        [% NEXT IF pair.key == 'group' OR pair.key == 'assigned_users_only' %]
         <dt>[% pair.key %]</dt> <dd>[% pair.value OR '<em>-</em>' %]</dd>
       [% END %]
     </dl>
diff --git a/templates/web/base/admin/users/form.html b/templates/web/base/admin/users/form.html
index 495da8648..efe885908 100644
--- a/templates/web/base/admin/users/form.html
+++ b/templates/web/base/admin/users/form.html
@@ -101,6 +101,21 @@
         [% END %]
 
 
+      [% IF user.from_body AND c.cobrand.moniker != 'zurich' %]
+        <li>
+          <div class="admin-hint">
+            <p>
+              [% loc("This means the user will only see front end staff features (such as the inspector form) in their assigned categories.") %]
+            </p>
+          </div>
+
+          <label>
+            [% loc('Assigned categories only') %]:
+            <input type="checkbox" id="assigned_categories_only" name="assigned_categories_only"[% user.extra.assigned_categories_only ? ' checked' : '' %]>
+          </label>
+        </li>
+      [% END %]
+
       [% IF c.cobrand.moniker != 'zurich' %]
         <li>
           <div class="admin-hint">
diff --git a/templates/web/base/report/display_tools.html b/templates/web/base/report/display_tools.html
index a09abd73b..4c79e4b71 100644
--- a/templates/web/base/report/display_tools.html
+++ b/templates/web/base/report/display_tools.html
@@ -1,7 +1,7 @@
 <div class="shadow-wrap">
     <ul id="key-tools">
       [% IF c.user_exists OR NOT problem.non_public %]
-        [% IF c.user_exists AND c.cobrand.users_can_hide AND c.user.belongs_to_body( problem.bodies_str ) %]
+        [% IF c.cobrand.users_can_hide AND relevant_staff_user %]
         <li><form method="post" action="/report/[% problem.id %]/delete" id="remove-from-site-form">
             <input type="hidden" name="token" value="[% csrf_token %]">
             <button type="submit" id="key-tool-report-abuse" class="abuse" data-confirm="[% loc('Are you sure?') %]" name="remove_from_site">[% loc('Remove from site') %]</button>
diff --git a/templates/web/base/report/update/form_update.html b/templates/web/base/report/update/form_update.html
index ff4612840..089d63f55 100644
--- a/templates/web/base/report/update/form_update.html
+++ b/templates/web/base/report/update/form_update.html
@@ -29,7 +29,7 @@
 [% TRY %][% PROCESS 'report/update/before_update.html' %][% CATCH file %][% END %]
 
 <label for="form_update">[% loc( 'Update' ) %]</label>
-[% IF c.user AND (c.user.is_superuser OR c.user.belongs_to_body(problem.bodies_str)) %]
+[% IF relevant_staff_user %]
   [% INCLUDE 'admin/response_templates_select.html' for='form_update' %]
 [% END %]
 [% IF field_errors.update %]
@@ -37,7 +37,7 @@
 [% END %]
 <textarea rows="7" cols="30" name="update" class="form-control" id="form_update" required>[% update.text | html %]</textarea>
 
-[% IF c.user AND (c.user.is_superuser OR c.user.belongs_to_body(problem.bodies_str)) %]
+[% IF relevant_staff_user %]
     <label for="state">[% loc( 'State' ) %]</label>
     [% INCLUDE 'report/inspect/state_groups_select.html' %]
 [% ELSE %]