From 53cdbad2ccae2b2e0242f761c79453b1b9067406 Mon Sep 17 00:00:00 2001
From: Leo Hemsted <leo.hemsted@digital.cabinet-office.gov.uk>
Date: Fri, 29 Mar 2019 15:16:29 +0000
Subject: [PATCH] make inbound search a POST

that way it doesn't expose PII to our logs
---
 app/main/views/dashboard.py                  |  5 +----
 app/notify_client/notification_api_client.py |  2 +-
 app/notify_client/service_api_client.py      | 10 ++++------
 3 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/app/main/views/dashboard.py b/app/main/views/dashboard.py
index 99f0bdceb..9d608efca 100644
--- a/app/main/views/dashboard.py
+++ b/app/main/views/dashboard.py
@@ -20,7 +20,6 @@ from app import (
     current_service,
     format_date_numeric,
     format_datetime_numeric,
-    inbound_number_client,
     job_api_client,
     service_api_client,
     template_statistics_client,
@@ -244,9 +243,8 @@ def get_inbox_partials(service_id):
 
     inbound_messages_data = service_api_client.get_most_recent_inbound_sms(service_id, page=page)
     inbound_messages = inbound_messages_data['data']
-
     if not inbound_messages:
-        inbound_number = inbound_number_client.get_inbound_sms_number_for_service(service_id)['data']['number']
+        inbound_number = current_service.inbound_number
     else:
         inbound_number = None
 
@@ -263,7 +261,6 @@ def get_inbox_partials(service_id):
         inbound_number=inbound_number,
         prev_page=prev_page,
         next_page=next_page
-
     )}
 
 
diff --git a/app/notify_client/notification_api_client.py b/app/notify_client/notification_api_client.py
index a31753542..579c93860 100644
--- a/app/notify_client/notification_api_client.py
+++ b/app/notify_client/notification_api_client.py
@@ -19,7 +19,7 @@ class NotificationApiClient(NotifyAdminAPIClient):
         to=None,
         include_one_off=None,
     ):
-
+        # TODO: if "to" is included, this should be a POST
         params = {
             'page': page,
             'page_size': page_size,
diff --git a/app/notify_client/service_api_client.py b/app/notify_client/service_api_client.py
index 2ae1fc674..98fcdec04 100644
--- a/app/notify_client/service_api_client.py
+++ b/app/notify_client/service_api_client.py
@@ -291,15 +291,13 @@ class ServiceAPIClient(NotifyAdminAPIClient):
     def update_whitelist(self, service_id, data):
         return self.put(url='/service/{}/whitelist'.format(service_id), data=data)
 
-    def get_inbound_sms(self, service_id, user_number='', page=None):
-        return self.get(
+    def get_inbound_sms(self, service_id, user_number=''):
+        # POST prevents the user phone number leaking into our logs
+        return self.post(
             '/service/{}/inbound-sms'.format(
                 service_id,
             ),
-            params={
-                'user_number': user_number,
-                'page': page
-            }
+            data={'user_number': user_number}
         )
 
     def get_most_recent_inbound_sms(self, service_id, page=None):