Skip to content

Commit 19f5ea4

Browse files
authored
Merge pull request #205 from guardian/an/enforce-access-permission
require users to have been granted the access permission to access the tool
2 parents abec248 + fbe013c commit 19f5ea4

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

app/story_packages/auth/PanDomainAuthActions.scala

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,10 @@ trait PanDomainAuthActions extends AuthActions with Results with Logging {
1818
override def validateUser(authedUser: AuthenticatedUser): Boolean = {
1919
if (!permissions.hasPermission(StoryPackagesAccess, authedUser.user.email)) {
2020
Logger.warn(s"User ${authedUser.user.email} does not have ${StoryPackagesAccess.name} permission")
21+
false
22+
} else {
23+
PanDomain.guardianValidation(authedUser)
2124
}
22-
PanDomain.guardianValidation(authedUser)
2325
}
2426

2527
override def authCallbackUrl: String = config.pandomain.host + "/oauthCallback"
@@ -31,10 +33,12 @@ trait PanDomainAuthActions extends AuthActions with Results with Logging {
3133

3234
override def invalidUserMessage(claimedAuth: AuthenticatedUser): String = {
3335
if( (claimedAuth.user.emailDomain == "guardian.co.uk") && !claimedAuth.multiFactor) {
34-
s"${claimedAuth.user.email} is not valid for use with the Fronts Tool as you need to have two factor authentication enabled." +
35-
s" Please contact the Helpdesk by emailing [email protected] or calling 34444 and request access to Composer CMS tools."
36+
s"${claimedAuth.user.email} is not valid for use with the Story Packages tool as you need to have two factor authentication enabled." +
37+
s" Please contact the Helpdesk by emailing [email protected] or calling 34444 and request assistance setting up two factor authentication on your Google account."
38+
} else if (claimedAuth.user.emailDomain != "guardian.co.uk") {
39+
s"${claimedAuth.user.email} is not valid for use with the Story Packages Tool. You need to use your Guardian Google account to login. Please sign in with your Guardian Google account first, then retry logging in."
3640
} else {
37-
s"${claimedAuth.user.email} is not valid for use with the Fronts Tool. You need to use your Guardian Google account to login. Please sign in with your Guardian Google account first, then retry logging in."
41+
s"${claimedAuth.user.email} has not been granted access to the Story Packages tool. Please contact Central Production at [email protected] requesting access to the Story Packages tool."
3842
}
3943
}
4044
}

0 commit comments

Comments
 (0)