Do not use mutable kwarg to set default permission set on application role

atst/domain/application_roles.py

@@ -6,12 +6,11 @@ from atst.domain.permission_sets import PermissionSets
 class ApplicationRoles(object):
     @classmethod
     def _permission_sets_for_names(cls, set_names):
+        set_names = set(set_names).union({PermissionSets.VIEW_APPLICATION})
         return PermissionSets.get_many(set_names)
 
     @classmethod
-    def create(
-        cls, user, application, permission_set_names=[PermissionSets.VIEW_APPLICATION]
-    ):
+    def create(cls, user, application, permission_set_names):
         application_role = ApplicationRole(user=user, application_id=application.id)
 
         application_role.permission_sets = ApplicationRoles._permission_sets_for_names(

atst/domain/environments.py

@@ -33,7 +33,9 @@ class Environments(object):
 
     @classmethod
     def add_member(cls, environment, user, role):
-        ApplicationRoles.create(user=user, application=environment.application)
+        ApplicationRoles.create(
+            user=user, application=environment.application, permission_set_names=[]
+        )
         environment_user = EnvironmentRoles.create(
             user=user, environment=environment, role=role
         )

atst/routes/applications/settings.py

@@ -7,7 +7,6 @@ from atst.domain.applications import Applications
 from atst.forms.application import ApplicationForm
 from atst.forms.app_settings import EnvironmentRolesForm
 from atst.domain.authz.decorator import user_can_access_decorator as user_can
-from atst.domain.exceptions import UnauthorizedError
 
 from atst.models.permissions import Permissions
 from atst.utils.flash import formatted_flash as flash

tests/domain/test_application_roles.py

@@ -14,7 +14,7 @@ def test_create_application_role():
     )
 
     assert application_role.permission_sets == PermissionSets.get_many(
-        [PermissionSets.EDIT_APPLICATION_TEAM]
+        [PermissionSets.EDIT_APPLICATION_TEAM, PermissionSets.VIEW_APPLICATION]
     )
     assert application_role.application == application
     assert application_role.user == user