Open /chatbot view to users whose organization has an AAP sub (#1711)

Author: mabashian

ansible_ai_connect/ai/api/views.py

@@ -114,6 +114,7 @@
     BlockUserWithSeatButWCANotReady,
     BlockWCANotReadyButTrialAvailable,
     IsAAPLicensed,
+    IsOrganisationLightspeedSubscriber,
 )
 from .serializers import (
     ChatFeedback,
@@ -1051,7 +1052,7 @@ class ChatEndpointThrottle(EndpointRateThrottle):
     permission_classes = [
         permissions.IsAuthenticated,
         IsAuthenticatedOrTokenHasScope,
-        IsRHInternalUser | IsTestUser | IsAAPUser,
+        IsRHInternalUser | IsTestUser | IsAAPUser | IsOrganisationLightspeedSubscriber,
     ]
     required_scopes = ["read", "write"]
     schema1_event = schema1.ChatBotOperationalEvent
@@ -1149,7 +1150,7 @@ class StreamingChatEndpointThrottle(EndpointRateThrottle):
     permission_classes = [
         permissions.IsAuthenticated,
         IsAuthenticatedOrTokenHasScope,
-        IsRHInternalUser | IsTestUser | IsAAPUser,
+        IsRHInternalUser | IsTestUser | IsAAPUser | IsOrganisationLightspeedSubscriber,
     ]
     required_scopes = ["read", "write"]
     schema1_event = schema1.StreamingChatBotOperationalEvent

ansible_ai_connect/main/tests/test_views.py

@@ -33,6 +33,7 @@
 )
 from ansible_ai_connect.main.settings.base import SOCIAL_AUTH_OIDC_KEY
 from ansible_ai_connect.main.views import LoginView
+from ansible_ai_connect.organizations.models import Organization
 from ansible_ai_connect.test_utils import (
     APIVersionTestCaseBase,
     create_user_with_provider,
@@ -249,6 +250,7 @@ def test_get_view_expired_trial(self):
 @override_settings(CHATBOT_DEFAULT_PROVIDER="wisdom")
 @override_settings(ANSIBLE_AI_CHATBOT_NAME="Awesome Chatbot")
 @override_settings(CHATBOT_DEBUG_UI=False)
+@override_settings(AUTHZ_DUMMY_ORGS_WITH_SUBSCRIPTION="12345")
 class TestChatbotView(TestCase):
     CHATBOT_PAGE_TITLE = "<title>Awesome Chatbot</title>"
     DOCUMENT_URL = (
@@ -279,19 +281,36 @@ def setUp(self):
             rh_internal=False,
         )
         self.non_rh_test_user.groups.add(self.test_group)
+        self.non_rh_user_with_subscription = create_user_with_provider(
+            provider=USER_SOCIAL_AUTH_PROVIDER_OIDC,
+            username="non-rh-user-with-subscription",
+            password="non-rh-password",
+            email="[email protected]",
+            rh_internal=False,
+            rh_org_id=12345,
+        )
 
     def tearDown(self):
         self.non_rh_user.delete()
         self.rh_user.delete()
         self.non_rh_test_user.delete()
         self.test_group.delete()
+        self.non_rh_user_with_subscription.delete()
+        Organization.objects.filter(id=12345).delete()
 
     def test_chatbot_link_with_anonymous_user(self):
         r = self.client.get(reverse("home"))
         self.assertEqual(r.status_code, HTTPStatus.OK)
         self.assertContains(r, TestChatbotView.DOCUMENT_URL)
         self.assertNotContains(r, "Chatbot")
 
+    def test_chatbot_link_with_non_rh_user_and_subscription(self):
+        self.client.force_login(user=self.non_rh_user_with_subscription)
+        r = self.client.get(reverse("home"))
+        self.assertEqual(r.status_code, HTTPStatus.OK)
+        self.assertContains(r, TestChatbotView.DOCUMENT_URL)
+        self.assertContains(r, "Chatbot")
+
     def test_chatbot_link_with_non_rh_user(self):
         self.client.force_login(user=self.non_rh_user)
         r = self.client.get(reverse("home"))
@@ -331,6 +350,11 @@ def test_chatbot_view_with_non_rh_user(self):
         r = self.client.get(reverse("chatbot"))
         self.assertEqual(r.status_code, HTTPStatus.FORBIDDEN)
 
+    def test_chatbot_view_with_non_rh_user_and_subscription(self):
+        self.client.force_login(user=self.non_rh_user_with_subscription)
+        r = self.client.get(reverse("chatbot"))
+        self.assertEqual(r.status_code, HTTPStatus.OK)
+
     @override_settings(CHATBOT_DEFAULT_PROVIDER="")
     def test_chatbot_view_with_rh_user_but_chatbot_disabled(self):
         self.client.force_login(user=self.rh_user)

ansible_ai_connect/main/views.py

@@ -125,7 +125,8 @@ class ChatbotView(ProtectedTemplateView):
     template_name = "chatbot/index.html"
 
     permission_classes = [
-        IsRHInternalUser | IsTestUser | IsAAPUser,
+        IsAuthenticated,
+        IsRHInternalUser | IsTestUser | IsAAPUser | IsOrganisationLightspeedSubscriber,
     ]
 
     chatbot_enabled: bool

ansible_ai_connect/test_utils.py

@@ -45,6 +45,7 @@ def create_user(
     provider: str = None,
     social_auth_extra_data: any = {},
     rh_user_is_org_admin: Optional[bool] = None,
+    rh_org_has_subscription: Optional[bool] = None,
     rh_user_id: str = None,
     rh_org_id: int = 1234567,
     org_opt_out: bool = False,
@@ -65,6 +66,8 @@ def create_user(
         social_auth.set_extra_data(social_auth_extra_data)
         if rh_user_is_org_admin:
             user.rh_user_is_org_admin = rh_user_is_org_admin
+        if rh_org_has_subscription:
+            user.rh_org_has_subscription = rh_org_has_subscription
     user.save()
     return user
 

ansible_ai_connect/users/templates/users/home.html

@@ -131,7 +131,7 @@ <h1 class="pf-c-title pf-m-lg">{{ project_name }}</h1>
                   {% if deployment_mode == 'saas' and user.is_authenticated and user.rh_user_is_org_admin %}
                   <a class="pf-l-level__item" href="/console"><span class="fas fa-solid fa-cog"></span> Admin Portal</a>
                   {% endif %}
-                  {% if chatbot_enabled and deployment_mode == 'saas' and user.is_authenticated and rh_internal_user_or_test_user %}
+                  {% if chatbot_enabled and deployment_mode == 'saas' and user.is_authenticated and can_access_chatbot %}
                   <a class="pf-l-level__item" href="/chatbot"><span class="fas fa-solid fa-comments"></span> Chatbot</a>
                   {% endif %}
                 </div>

ansible_ai_connect/users/views.py

@@ -113,8 +113,10 @@ def get_context_data(self, **kwargs):
         context["documentation_url"] = settings.COMMERCIAL_DOCUMENTATION_URL
 
         user = self.request.user
-        context["rh_internal_user_or_test_user"] = user.is_authenticated and (
-            user.rh_internal or user.groups.filter(name="test").exists()
+        context["can_access_chatbot"] = user.is_authenticated and (
+            user.rh_internal
+            or user.groups.filter(name="test").exists()
+            or user.rh_org_has_subscription
         )
 
         # Show chatbot link when the chatbot service is configured.