Add DELETE_APPLICATION_MEMBER permission

atst/domain/permission_sets.py

@@ -88,6 +88,7 @@ _PORTFOLIO_APP_MGMT_PERMISSION_SETS = [
             Permissions.CREATE_APPLICATION,
             Permissions.DELETE_APPLICATION,
             Permissions.EDIT_APPLICATION_MEMBER,
+            Permissions.DELETE_APPLICATION_MEMBER,
             Permissions.CREATE_APPLICATION_MEMBER,
             Permissions.EDIT_ENVIRONMENT,
             Permissions.CREATE_ENVIRONMENT,
@@ -205,6 +206,7 @@ _APPLICATION_TEAM_PERMISSION_SET = {
     "display_name": "Manage team",
     "permissions": [
         Permissions.EDIT_APPLICATION_MEMBER,
+        Permissions.DELETE_APPLICATION_MEMBER,
         Permissions.CREATE_APPLICATION_MEMBER,
         Permissions.ASSIGN_ENVIRONMENT_MEMBER,
     ],

atst/models/permissions.py

@@ -11,6 +11,7 @@ class Permissions(object):
     DELETE_APPLICATION = "delete_application"
     VIEW_APPLICATION_MEMBER = "view_application_member"
     EDIT_APPLICATION_MEMBER = "edit_application_member"
+    DELETE_APPLICATION_MEMBER = "delete_application_member"
     CREATE_APPLICATION_MEMBER = "create_application_member"
     VIEW_ENVIRONMENT = "view_environment"
     EDIT_ENVIRONMENT = "edit_environment"

atst/routes/applications/team.py

@@ -164,8 +164,7 @@ def create_member(application_id):
 @applications_bp.route(
     "/applications/<application_id>/members/<user_id>/delete", methods=["POST"]
 )
-# TODO: Is this correct??
-@user_can(Permissions.EDIT_APPLICATION_MEMBER, message="remove application member")
+@user_can(Permissions.DELETE_APPLICATION_MEMBER, message="remove application member")
 def remove_member(application_id, user_id):
     Applications.remove_member(application=g.application, user_id=user_id)
     user = Users.get(user_id)