Skip to content

Add allowed brands for organisations#2923

Open
theseanything wants to merge 7 commits into
mainfrom
add-organisation-brands
Open

Add allowed brands for organisations#2923
theseanything wants to merge 7 commits into
mainfrom
add-organisation-brands

Conversation

@theseanything

@theseanything theseanything commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Brands are a global list, but each organisation should only be able to use brands it has been granted. This can help make sure that brands that each organisation see's is manageable list and relevant (i.e. Croydon council is unlikely going to use Hackney council branding). It also prevents user creating or impersonating organisations for which they're not associated with.

The management is only available via the organisations page and can only be done by a super admin.

The UI uses the autocomplete select, in case the list of brands becomes very long (potentially, e.g. each local council has its own brand).

@theseanything theseanything force-pushed the add-organisation-brands branch from 73da06e to fd53f55 Compare July 14, 2026 12:23
@theseanything theseanything marked this pull request as draft July 14, 2026 12:57
@theseanything theseanything marked this pull request as ready for review July 14, 2026 15:56
Brands are a global list, but each organisation should only be able
to use brands it has been granted. Super admins can now add and
remove an organisation's brands from the organisation page. The add
page uses an autocomplete so it works with hundreds of brands.
The form brand picker offered every brand configured in settings.yml
to any form. Source the options from the brands allowed for the
form's organisation instead, so organisations can only apply brands
they have been granted. Options keep using the brand slug, so
existing form brand_id values are unaffected.
Removing a brand from an organisation stops new forms selecting it,
but forms already using the brand keep it. Make this clear on the
organisation page so super admins know what removing a brand does.
The same empty-rawAttribute detection was copied in three places
across UsersController and OrganisationBrandsController. Move it to
WebController so every autocomplete form clears stale values the
same way.
The custom validation re-implemented the "not already added" rule
that available_brands already expresses, so the two could drift.
Validate against available_brands directly instead.
Validating a brand id only needs slugs, so pluck them rather than
instantiating every Brand. Memoise the brands relation as it is
used by both validation and the options list.
Show the guidance even when an organisation has no brands, and
reword it to explain that adding a brand makes it available for
the organisation's forms to use.
@theseanything theseanything force-pushed the add-organisation-brands branch from 519fc7b to ea669ad Compare July 14, 2026 15:56
@github-actions

Copy link
Copy Markdown

🎉 A review copy of this PR has been deployed! You can reach it at: https://pr-2923.admin.review.forms.service.gov.uk/

It may take 5 minutes or so for the application to be fully deployed and working. If it still isn't ready
after 5 minutes, there may be something wrong with the ECS task. You will need to go to the integration AWS account
to debug, or otherwise ask an infrastructure person.

For the sign in details and more information, see the review apps wiki page.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant