Stop users from editing/adding templates without the correct permission

If sending SMS is disabled for a service, it should not be possible to
add or modify SMS templates. If a user tries to do this, they should see
a different page with a link to go back. The same thing should happen
with email templates.

app/main/views/send.py

@@ -93,6 +93,16 @@ def send_messages(service_id, template_id):
 
     db_template = service_api_client.get_service_template(service_id, template_id)['data']
 
+    if (db_template['template_type'] in ['email', 'sms']) \
+            and (db_template['template_type'] not in current_service['permissions']):
+        return redirect(url_for(
+            '.action_blocked',
+            service_id=service_id,
+            notification_type=db_template['template_type'],
+            return_to='view_template',
+            template_id=template_id
+        ))
+
     template = get_template(
         db_template,
         current_service,
@@ -163,6 +173,18 @@ def send_test(service_id, template_id):
     session['recipient'] = None
     session['placeholders'] = {}
     session['send_test_letter_page_count'] = None
+
+    db_template = service_api_client.get_service_template(service_id, template_id)['data']
+
+    if (db_template['template_type'] in ['email', 'sms']) \
+            and (db_template['template_type'] not in current_service['permissions']):
+        return redirect(url_for(
+            '.action_blocked',
+            service_id=service_id,
+            notification_type=db_template['template_type'],
+            return_to='view_template',
+            template_id=template_id))
+
     return redirect(url_for(
         {
             'main.send_test': '.send_test_step',

app/main/views/templates.py

@@ -232,15 +232,42 @@ def add_template_by_type(service_id):
                 template_id=blank_letter['data']['id'],
             ))
 
-        return redirect(url_for(
-            '.add_service_template',
-            service_id=service_id,
-            template_type=form.template_type.data,
-        ))
+        if form.template_type.data in current_service['permissions']:
+            return redirect(url_for(
+                '.add_service_template',
+                service_id=service_id,
+                template_type=form.template_type.data,
+            ))
+        else:
+            return redirect(url_for(
+                '.action_blocked',
+                service_id=service_id,
+                notification_type=form.template_type.data,
+                return_to='add_new_template',
+                template_id='0'
+            ))
 
     return render_template('views/templates/add.html', form=form)
 
 
+@main.route("/services/<service_id>/templates/action-blocked/<notification_type>/<return_to>/<template_id>")
+@login_required
+@user_has_permissions('manage_templates', admin_override=True)
+def action_blocked(service_id, notification_type, return_to, template_id):
+    if notification_type == 'sms':
+        notification_type = 'text messages'
+    elif notification_type == 'email':
+        notification_type = 'emails'
+
+    return render_template(
+        'views/templates/action_blocked.html',
+        service_id=service_id,
+        notification_type=notification_type,
+        return_to=return_to,
+        template_id=template_id
+    )
+
+
 @main.route("/services/<service_id>/templates/add-<template_type>", methods=['GET', 'POST'])
 @login_required
 @user_has_permissions('manage_templates', admin_override=True)
@@ -277,13 +304,21 @@ def add_service_template(service_id, template_type):
             return redirect(
                 url_for('.view_template', service_id=service_id, template_id=new_template['data']['id'])
             )
-
-    return render_template(
-        'views/edit-{}-template.html'.format(template_type),
-        form=form,
-        template_type=template_type,
-        heading_action='Add'
-    )
+    if (template_type in ['email', 'sms']) and (template_type not in current_service['permissions']):
+        return redirect(url_for(
+            '.action_blocked',
+            service_id=service_id,
+            notification_type=template_type,
+            return_to='templates',
+            template_id='0'
+        ))
+    else:
+        return render_template(
+            'views/edit-{}-template.html'.format(template_type),
+            form=form,
+            template_type=template_type,
+            heading_action='Add',
+        )
 
 
 def abort_403_if_not_admin_user():
@@ -354,13 +389,26 @@ def edit_service_template(service_id, template_id):
                 service_id=service_id,
                 template_id=template_id
             ))
-    return render_template(
-        'views/edit-{}-template.html'.format(template['template_type']),
-        form=form,
-        template_id=template_id,
-        template_type=template['template_type'],
-        heading_action='Edit'
-    )
+
+    db_template = service_api_client.get_service_template(service_id, template_id)['data']
+
+    if (db_template['template_type'] in ['email', 'sms']) \
+            and (db_template['template_type'] not in current_service['permissions']):
+        return redirect(url_for(
+            '.action_blocked',
+            service_id=service_id,
+            notification_type=db_template['template_type'],
+            return_to='view_template',
+            template_id=template_id
+        ))
+    else:
+        return render_template(
+            'views/edit-{}-template.html'.format(template['template_type']),
+            form=form,
+            template_id=template_id,
+            template_type=template['template_type'],
+            heading_action='Edit'
+        )
 
 
 @main.route("/services/<service_id>/templates/<template_id>/delete", methods=['GET', 'POST'])