13 files changed, 144 insertions, 12 deletions
diff --git a/templates/web/base/admin/report_blocks.html b/templates/web/base/admin/report_blocks.html
index 4c52b14bb..4c679e3b8 100644
--- a/templates/web/base/admin/report_blocks.html
+++ b/templates/web/base/admin/report_blocks.html
@@ -47,3 +47,7 @@ SET state_groups = c.cobrand.state_groups_admin;
         </span>
     [% END %]
 [% END %]
+
+[% BLOCK status_message %]
+    <p><em>[% status_message %]</em></p>
+[% END %]
diff --git a/templates/web/base/admin/report_edit.html b/templates/web/base/admin/report_edit.html
index a26a35c50..e7d126558 100644
--- a/templates/web/base/admin/report_edit.html
+++ b/templates/web/base/admin/report_edit.html
@@ -116,7 +116,7 @@ class="admin-offsite-link">[% problem.latitude %], [% problem.longitude %]</a>
 </ul>
 </div>
 
-[% status_message %]
+[% INCLUDE status_message %]
 
 <ul class="plain-list">
 <li><label for='title'>[% loc('Subject:') %]</label>
diff --git a/templates/web/base/admin/roles/form.html b/templates/web/base/admin/roles/form.html
new file mode 100644
index 000000000..cb50689a6
--- /dev/null
+++ b/templates/web/base/admin/roles/form.html
@@ -0,0 +1,32 @@
+[% INCLUDE 'admin/header.html' title=loc('Roles') -%]
+
+<form method="post">
+    <div class="admin-hint">
+      <p>[% loc("The role's <strong>name</strong> is used to refer to this group of permissions elsewhere in the admin.") %]</p>
+    </div>
+    [% form.field('name').render %]
+
+  [% IF form.field('body').is_active %]
+    [% form.field('body').render %]
+  [% END %]
+
+    <div class="admin-hint">
+      <p>[% loc("Users with this role can perform the following actions within their assigned body or area.") %]</p>
+    </div>
+    [% form.field('permissions').render %]
+
+    [% form.field('submit').render %]
+
+    <p>
+        <input class="btn" type="submit" name="submit" value="[% loc('Save changes') %]">
+    </p>
+  [% IF form.item.id %]
+    <p>
+        <input class="btn-danger" type="submit" name="delete_role" value="[% loc('Delete') %]" data-confirm="[% loc('Are you sure?') %]">
+    </p>
+  [% END %]
+</form>
+
+<p><a href="[% c.uri_for(c.controller.action_for('list')) %]">Return to roles list</a></p>
+
+[% INCLUDE 'admin/footer.html' %]
diff --git a/templates/web/base/admin/roles/index.html b/templates/web/base/admin/roles/index.html
new file mode 100644
index 000000000..ba3fd434b
--- /dev/null
+++ b/templates/web/base/admin/roles/index.html
@@ -0,0 +1,35 @@
+[% INCLUDE 'admin/header.html' title=loc('Roles') -%]
+
+<table>
+    <tr>
+        <th>[% loc('Role') %]</th>
+        <th>[% loc('Permissions') %]</th>
+        <th>&nbsp;</th>
+    </tr>
+[% FOREACH role IN roles -%]
+  [% IF c.user.is_superuser AND last_name != role.body.name %]
+    <tr>
+        <td colspan="3"><strong>[% role.body.name %]</strong></td>
+    </tr>
+    [% SET last_name = role.body.name %]
+  [% END %]
+    <tr>
+        <td>[% role.name %]</td>
+        <td><ul class="no-margin no-bullets">
+          [% FOR perm IN role.permissions.sort %]
+            <li>[% labels.$perm %]
+          [% END %]
+        </ul></td>
+        <td>
+            <a href="[% c.uri_for(c.controller.action_for('edit'), [role.id]) %]">[% loc('Edit') %]</a>
+            &middot; <a href="[% c.uri_for_action('admin/users/index', role = role.id) %]">[% loc('Users') %]</a>
+        </td>
+    </tr>
+[% END -%]
+</table>
+
+<p>
+  <a href="[% c.uri_for(c.controller.action_for('create')) %]">Create</a>
+</p>
+
+[% INCLUDE 'admin/footer.html' %]
diff --git a/templates/web/base/admin/update_edit.html b/templates/web/base/admin/update_edit.html
index fca9b1904..527b3f9f8 100644
--- a/templates/web/base/admin/update_edit.html
+++ b/templates/web/base/admin/update_edit.html
@@ -1,7 +1,7 @@
 [% INCLUDE 'admin/header.html' title=tprintf(loc('Editing update %d'), update.id ) -%]
 [% PROCESS 'admin/report_blocks.html' %]
 
-[% status_message %]
+[% INCLUDE status_message %]
 
 <form method="post" action="[% c.uri_for( 'update_edit', update.id ) %]" enctype="application/x-www-form-urlencoded" accept-charset="utf-8">
     <input type="hidden" name="token" value="[% csrf_token %]" >
diff --git a/templates/web/base/admin/users/edit.html b/templates/web/base/admin/users/edit.html
index 8dd2b926f..204e58607 100644
--- a/templates/web/base/admin/users/edit.html
+++ b/templates/web/base/admin/users/edit.html
@@ -6,7 +6,7 @@
 [% INCLUDE 'admin/header.html' title=title -%]
 [% PROCESS 'admin/report_blocks.html' %]
 
-[% status_message %]
+[% INCLUDE status_message %]
 
 [% INCLUDE 'admin/users/form.html' %]
 
diff --git a/templates/web/base/admin/users/form.html b/templates/web/base/admin/users/form.html
index 8f0f9ad6e..c9cc6463b 100644
--- a/templates/web/base/admin/users/form.html
+++ b/templates/web/base/admin/users/form.html
@@ -1,4 +1,4 @@
-<form method="post" id="user_edit" action="[% c.uri_for_action( 'admin/users/edit', user.id ) %]" enctype="application/x-www-form-urlencoded" accept-charset="utf-8">
+<form method="post" id="user_edit" action="[% c.uri_for_action( 'admin/users/edit', user.id || 'add' ) %]" enctype="application/x-www-form-urlencoded" accept-charset="utf-8">
     <input type="hidden" name="token" value="[% csrf_token %]" >
     <input type="hidden" name="submit" value="1" >
 
@@ -155,6 +155,20 @@
 
         [% IF available_permissions AND NOT user.is_superuser %]
           <li>
+            <div class="admin-hint">
+              <p>
+                [% loc("Users can be assigned one or more roles to give them all the permissions of those roles. Selecting a role or roles will disable manual permission selection.") %]
+              </p>
+            </div>
+            <label for="roles">[% loc('Role:') %]</label>
+            <select class="form-control js-multiple" id="roles" name="roles" multiple>
+              [% FOREACH role IN roles %]
+                <option data-permissions='["[% role.permissions.join('","') | html %]"]' value="[% role.id %]"[% ' selected' IF user.in_role(role.id) %]>[% role.name | html %]</option>
+              [% END %]
+            </select>
+          </li>
+
+          <li>
             <fieldset>
               <legend>
                 <div class="admin-hint">
diff --git a/templates/web/base/admin/users/import.html b/templates/web/base/admin/users/import.html
index 0c0b903d7..4a93e0255 100644
--- a/templates/web/base/admin/users/import.html
+++ b/templates/web/base/admin/users/import.html
@@ -1,7 +1,7 @@
 [% INCLUDE 'admin/header.html' title=loc("User Import") -%]
 [% PROCESS 'admin/report_blocks.html' %]
 
-[% status_message %]
+[% INCLUDE status_message %]
 
 <form method="post" id="user_edit" enctype="multipart/form-data" accept-charset="utf-8">
     <input type="hidden" name="token" value="[% csrf_token %]" >
@@ -66,10 +66,11 @@
 <p>[% loc("Existing users won't be modified.") %]</p>
 <p>
     [% loc("The uploaded CSV file must contain a header row, and records must have the following fields (in this order):") %]
-    <pre>name,email,from_body,permissions</pre>
+    <pre>name,email,from_body,permissions,roles</pre>
     <ul>
         <li><code>from_body</code>: [% loc("the database id of the body to associate that user with, e.g. <code>2217</code> for Buckinghamshire.") %]</li>
         <li><code>permissions</code>: [% loc("a colon-separated list of permissions to grant that user, e.g. <code>contribute_as_body:moderate:user_edit</code>.") %]</li>
+        <li><code>roles</code>: [% loc("a colon-separated list of roles to assign to that user.") %]</li>
     </ul>
 </p>
 
diff --git a/templates/web/base/admin/users/index.html b/templates/web/base/admin/users/index.html
index e939f008b..880b4a417 100644
--- a/templates/web/base/admin/users/index.html
+++ b/templates/web/base/admin/users/index.html
@@ -1,18 +1,45 @@
 [% INCLUDE 'admin/header.html' title=loc('Search Users') %]
 [% PROCESS 'admin/report_blocks.html' %]
 
+[% BLOCK role_select %]
+<select name="[% label %]" id="[% label %]" class="form-control">
+    <option value="">---</option>
+  [% FOR role IN roles %]
+      [% IF c.user.is_superuser AND last_name != role.body.name %]
+        <optgroup label="[% role.body.name %]">
+        [% SET last_name = role.body.name %]
+      [% END %]
+    <option value="[% role.id %]"[% ' selected' IF role.id == role_selected %]>[% role.name | html %]</option>
+  [% END %]
+</select>
+[% END %]
+
+[% INCLUDE status_message %]
+
 <div class="fms-admin-info">
     [% loc("User search finds matches in users' names and email addresses.") %]
 </div>
+
 <form method="get" action="[% c.uri_for_action('admin/users/index') %]" enctype="application/x-www-form-urlencoded" accept-charset="utf-8">
+<div class="filters">
+
     <p><label for="search">[% loc('Search:') %]</label>
         <input class="form-control" type="text" name="search"  size="30" id="search" value="[% searched | html %]">
+  [% IF roles %]
+    <p><label for="role">[% loc('Role:') %]</label>
+    [% INCLUDE role_select label='role' %]
+  [% END %]
+    <p class="no-label"><input type="submit" value="[% loc('Go') %]" class="btn">
+
+</div>
 </form>
 
 [% IF users.size %]
 
+<form method="post">
 <table cellspacing="0" cellpadding="2" border="1">
     <tr>
+        <th>*</th>
         <th>[% loc('Name') %]</th>
         <th>[% loc('Email') %]</th>
         <th>[% loc('Body') %]</th>
@@ -23,7 +50,13 @@
     </tr>
 [%- FOREACH user IN users %]
     <tr>
-        <td>[% PROCESS value_or_nbsp value=user.name %]</td> 
+        <td align="center">[% IF user.from_body %]
+            <input type="checkbox" name="uid" value="[% user.id %]" id="uid[% user.id %]">
+            [% END %]</td>
+        <td>[% IF user.from_body %]<label class="inline" for="uid[% user.id %]">[% END %]
+            [% PROCESS value_or_nbsp value=user.name %]
+            [% IF user.from_body %]</label>[% END %]
+        </td>
         <td><a href="[% c.uri_for_action( 'admin/reports', search => user.email ) %]">[% PROCESS value_or_nbsp value=user.email %]</a></td> 
         <td>[% PROCESS value_or_nbsp value=user.from_body.name %]
             [% IF user.is_superuser %] * [% END %]
@@ -36,7 +69,20 @@
 [%- END -%]
 </table>
 
-[% ELSIF searched %]
+<p><label for="roles">[% loc('Assign selected to role:') %]</label>
+[% IF c.user.is_superuser %]
+[% INCLUDE role_select label='roles' %]
+[% ELSE %]
+<select class="form-control js-multiple" id="roles" name="roles" multiple>
+  [% FOREACH role IN roles %]
+    <option value="[% role.id %]">[% role.name | html %]</option>
+  [% END %]
+</select>
+[% END %]
+<p><input class="btn" type="submit" value="[% loc('Save changes') %]">
+</form>
+
+[% ELSIF searched || role_selected %]
 
 <div class="fms-admin-warning">
     [% loc("Searching found no users.") %]
diff --git a/templates/web/zurich/admin/index-dm.html b/templates/web/zurich/admin/index-dm.html
index 4d77cf264..c93adbfb3 100644
--- a/templates/web/zurich/admin/index-dm.html
+++ b/templates/web/zurich/admin/index-dm.html
@@ -1,7 +1,7 @@
 [% PROCESS 'admin/header.html' title=loc('Summary') -%]
 [% PROCESS 'admin/report_blocks.html' %]
 
-[% status_message %]
+[% INCLUDE status_message %]
 
 <h2 id="submitted">[% loc('Submitted') %]</h2>
 [% INCLUDE list, problems = submitted.all, hash = 'submitted' %]
diff --git a/templates/web/zurich/admin/report_edit-sdm.html b/templates/web/zurich/admin/report_edit-sdm.html
index e6b17b8f0..b9fb6ff4d 100644
--- a/templates/web/zurich/admin/report_edit-sdm.html
+++ b/templates/web/zurich/admin/report_edit-sdm.html
@@ -79,7 +79,7 @@
     <dd>[% problem.get_time_spent %]</dd>
 
     <dd>
-    [% status_message %]
+    [% INCLUDE status_message %]
     </dd>
 
   [% IF problem.photo %]
diff --git a/templates/web/zurich/admin/report_edit.html b/templates/web/zurich/admin/report_edit.html
index d6f9c4c39..0186a6286 100644
--- a/templates/web/zurich/admin/report_edit.html
+++ b/templates/web/zurich/admin/report_edit.html
@@ -129,7 +129,7 @@
 
 <div class="admin-report-edit admin-report-edit--interact">
 
-[% status_message %]
+[% INCLUDE status_message %]
 
 <dl [% IF status_message %]class="with-message"[% END %]>
 
diff --git a/templates/web/zurich/admin/update_edit.html b/templates/web/zurich/admin/update_edit.html
index bcf849732..314ae3e2b 100644
--- a/templates/web/zurich/admin/update_edit.html
+++ b/templates/web/zurich/admin/update_edit.html
@@ -1,7 +1,7 @@
 [% INCLUDE 'admin/header.html' title=tprintf(loc('Editing update %d'), update.id ) -%]
 [% PROCESS 'admin/report_blocks.html' %]
 
-[% status_message %]
+[% INCLUDE status_message %]
 
 <form method="post" action="[% c.uri_for( 'update_edit', update.id ) %]" enctype="application/x-www-form-urlencoded" accept-charset="utf-8">
     <input type="hidden" name="token" value="[% csrf_token %]" >