add setting for changing pronouns

This allows schools to lock down a user's ability to change their
pronoun within Canvas.

Fixes VICE-837
flag=none

TEST PLAN:
- As an admin navigate to the account settings
- Enable personal pronouns and note the additional check box to allow
  users to change their pronouns in Canvas
- With it enabled navigate to a users settings and attempt to edit their
  settings
- Note that you should be able to change the user's pronoun
- Disable the setting on the account attempt to edit a users settings
  again
- Note that the dropdown should be disabled and you shouldn't be able to
  change the user's pronoun

Change-Id: I7d7d454e1b5df9a0afa2b39768159a86910cb7d2
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/249883
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>

app/controllers/accounts_controller.rb

@@ -1512,7 +1512,8 @@ class AccountsController < ApplicationController
   PERMITTED_SETTINGS_FOR_UPDATE = [:admins_can_change_passwords, :admins_can_view_notifications,
                                    :allow_invitation_previews, :allow_sending_scores_in_emails,
                                    :author_email_in_notifications, :canvadocs_prefer_office_online,
-                                   :consortium_parent_account, :consortium_can_create_own_accounts, :can_add_pronouns,
+                                   :can_add_pronouns, :can_change_pronouns,
+                                   :consortium_parent_account, :consortium_can_create_own_accounts,
                                    :shard_per_account, :consortium_autocreate_web_of_trust,
                                    :consortium_autocreate_reverse_trust,
                                    :default_storage_quota, :default_storage_quota_mb,

app/controllers/profile_controller.rb

@@ -358,7 +358,7 @@ class ProfileController < ApplicationController
         user_params.delete(:short_name)
         user_params.delete(:sortable_name)
       end
-      if user_params[:pronouns].present? && @domain_root_account.pronouns.exclude?(user_params[:pronouns].strip)
+      if !@domain_root_account.can_change_pronouns? || user_params[:pronouns].present? && @domain_root_account.pronouns.exclude?(user_params[:pronouns].strip)
         user_params.delete(:pronouns)
       end
       if @user.update(user_params)
@@ -419,8 +419,11 @@ class ProfileController < ApplicationController
     @profile = @user.profile
     @context = @profile
 
+    if @domain_root_account.can_change_pronouns? && params[:pronouns].present? && @domain_root_account.pronouns.include?(params[:pronouns].strip)
+      @user.pronouns = params[:pronouns]
+    end
+
     short_name = params[:user] && params[:user][:short_name]
-    @user.pronouns = params[:pronouns] if params[:pronouns]
     @user.short_name = short_name if short_name && @user.user_can_edit_name?
     if params[:user_profile]
       user_profile_params = params[:user_profile].permit(:title, :bio)

app/models/account.rb

@@ -282,13 +282,14 @@ class Account < ActiveRecord::Base
   add_setting :no_enrollments_can_create_courses, :boolean => true, :root_only => true, :default => false
   add_setting :allow_sending_scores_in_emails, :boolean => true, :root_only => true
   add_setting :can_add_pronouns, :boolean => true, :root_only => true, :default => false
+  add_setting :can_change_pronouns, :boolean => true, :root_only => true, :default => true
 
   add_setting :self_enrollment
   add_setting :equella_endpoint
   add_setting :equella_teaser
   add_setting :enable_alerts, :boolean => true, :root_only => true
   add_setting :enable_eportfolios, :boolean => true, :root_only => true
-  add_setting :users_can_edit_name, :boolean => true, :root_only => true
+  add_setting :users_can_edit_name, :boolean => true, :root_only => true, :default => true
   add_setting :open_registration, :boolean => true, :root_only => true
   add_setting :show_scheduler, :boolean => true, :root_only => true, :default => false
   add_setting :enable_profiles, :boolean => true, :root_only => true, :default => false

app/models/user.rb

@@ -2614,7 +2614,7 @@ class User < ActiveRecord::Base
   def user_can_edit_name?
     accounts = pseudonyms.shard(self).active.map(&:account)
     return true if accounts.empty?
-    accounts.any? { |a| a.settings[:users_can_edit_name] != false }
+    accounts.any? { |a| a.users_can_edit_name? }
   end
 
   def limit_parent_app_web_access?

app/views/accounts/settings.html.erb

@@ -354,6 +354,8 @@
               <%= settings.check_box :can_add_pronouns, :checked => @account.settings[:can_add_pronouns], class: "element_toggler", "aria-controls": "personal_pronouns_options" %>
               <%= settings.label :can_add_pronouns, en: "Enable Personal Pronouns" %>
               <div id="personal_pronouns_options" <%= hidden(true) unless @account.settings[:can_add_pronouns] %>>
+                <%= settings.check_box :can_change_pronouns, :checked => @account.can_change_pronouns? %>
+                <%= settings.label :can_change_pronouns, en: "Allow users to change their pronouns in Canvas" %>
                 <% js_env(PRONOUNS_LIST: ((@account.pronouns.presence || Pronouns.default_pronouns)))
                 js_bundle :available_pronouns_list %>
               </div>
@@ -556,7 +558,7 @@
                 </div>
               <% end %>
               <div>
-                <%= settings.check_box :users_can_edit_name, :checked => @account.settings[:users_can_edit_name] != false %>
+                <%= settings.check_box :users_can_edit_name, :checked => @account.users_can_edit_name? %>
                 <%= settings.label :users_can_edit_name, :en => "Users can edit their name" %>
               </div>
 

app/views/profile/profile.html.erb

@@ -99,13 +99,18 @@
     <tr>
       <th scope="row"><%= f.blabel :pronouns, :en => "Pronouns" %></th>
       <td>
-        <span id="pronouns" class="<%= editable_name ? 'display_data' : 'edit_or_show_data' %>"><%= @user.pronouns || t("None") %></span>
-        <span class="edit_data">
-          <%= f.select(:pronouns, options_for_select(([[t("None"), '']] + @domain_root_account.pronouns), @user.pronouns) ) %>
-        </span>
+        <span id="pronouns" class="<%= @domain_root_account.can_change_pronouns? ? 'display_data' : 'edit_or_show_data' %>"><%= @user.pronouns || t("None") %></span>
+        <% if @domain_root_account.can_change_pronouns? %>
+          <span class="edit_data">
+            <%= f.select(
+              :pronouns,
+              options_for_select(([[t("None"), '']] + @domain_root_account.pronouns + [@user.pronouns]).compact.uniq, @user.pronouns))
+            %>
+          </span>
+        <% end %>
         <span class="edit_or_show_data data_description">
           <br/>
-          <%= t("These pronouns will appear after your name when shown in the UI") %>
+          <%= t("This pronoun will appear after your name when enabled") %>
         </span>
       </td>
     </tr>

app/views/shared/_profile.html.erb

@@ -49,7 +49,11 @@
         <%# even if @domain_root_account.settings[:can_add_pronouns] is false, we still want to let someone that has pronouns set to see this so they can unset them  %>
         <% if @user.pronouns || @domain_root_account.settings[:can_add_pronouns] %>
           <label for="pronouns"class="show-if-editing ic-Label"><%= t('Pronouns') %>:</label>
-          <%= select_tag :pronouns, options_for_select([[t("None"), '']] + @domain_root_account.pronouns, @user.pronouns), class:"show-if-editing" %>
+          <%= select_tag :pronouns,
+            options_for_select(([[t("None"), '']] + @domain_root_account.pronouns + [@user.pronouns]).compact.uniq, @user.pronouns),
+            class:"show-if-editing",
+            disabled:!@domain_root_account.can_change_pronouns?
+          %>
         <% end %>
         <p class="profileDetails">
           <span class="hide-if-editing"><%= @user_data[:title] %></span>

db/migrate/20201014210657_backfill_pronoun_settings.rb

@@ -0,0 +1,36 @@
+#
+# Copyright (C) 2020 - present Instructure, Inc.
+#
+# This file is part of Canvas.
+#
+# Canvas is free software: you can redistribute it and/or modify it under
+# the terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, version 3 of the License.
+#
+# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along
+# with this program. If not, see <http://www.gnu.org/licenses/>.
+
+class BackfillPronounSettings < ActiveRecord::Migration[5.2]
+  tag :predeploy
+
+  def up
+    Account.root_accounts.non_shadow.active.find_each do |account|
+      if account[:users_can_edit_name] == false && account.can_add_pronouns?
+        account[:can_change_pronouns] = false
+        account.save!
+      end
+    end
+  end
+
+  def down
+    Account.root_accounts.non_shadow.active.find_each do |account|
+      account.settings.delete(:can_change_pronouns)
+      account.save! if account.settings_changed?
+    end
+  end
+end

spec/controllers/profile_controller_spec.rb

@@ -131,6 +131,16 @@ describe ProfileController do
         @user.reload
         expect(@user.pronouns).to eq nil
       end
+
+      it 'should not allow setting pronouns if the setting is disabled' do
+        @user.account.settings[:can_change_pronouns] = false
+        @user.account.save!
+        user_session(@user, @pseudonym)
+        put 'update', params: {:user => {:pronouns => "Pro/Noun"}}, format: 'json'
+        expect(response).to be_successful
+        @user.reload
+        expect(@user.pronouns).to eq nil
+      end
     end
 
     it "should allow changing the default e-mail address and nothing else (name changing disabled)" do