Stop users from editing/adding templates without the correct permission

If sending SMS is disabled for a service, it should not be possible to
add or modify SMS templates. If a user tries to do this, they should see
a different page with a link to go back. The same thing should happen
with email templates.

tests/app/main/views/test_send.py

@@ -38,6 +38,32 @@ def test_that_test_files_exist():
     assert len(test_non_spreadsheet_files) == 6
 
 
+def test_should_not_allow_files_to_be_uploaded_without_the_correct_permission(
+    logged_in_client,
+    mock_get_service_template,
+    service_one,
+    fake_uuid,
+):
+    template_id = fake_uuid
+    service_one['permissions'] = []
+
+    response = logged_in_client.get(url_for(
+        '.send_messages',
+        service_id=service_one['id'],
+        template_id=template_id),
+        follow_redirects=True)
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+
+    assert response.status_code == 200
+    assert page.select('main p')[0].text.strip() == "Sending text messages is an invitation‑only feature."
+    assert page.select(".page-footer-back-link")[0].text == "Back to the template"
+    assert page.select(".page-footer-back-link")[0]['href'] == url_for(
+        '.view_template',
+        service_id=service_one['id'],
+        template_id=template_id,
+    )
+
+
 @pytest.mark.parametrize(
     "filename, acceptable_file",
     list(zip(
@@ -310,6 +336,32 @@ def test_send_test_step_redirects_if_session_not_setup(
         assert session['recipient'] == expected_recipient
 
 
+def test_send_one_off_does_not_send_without_the_correct_permissions(
+    logged_in_client,
+    mock_get_service_template,
+    service_one,
+    fake_uuid,
+):
+    template_id = fake_uuid
+    service_one['permissions'] = []
+
+    response = logged_in_client.get(url_for(
+        '.send_one_off',
+        service_id=service_one['id'],
+        template_id=template_id),
+        follow_redirects=True)
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+
+    assert response.status_code == 200
+    assert page.select('main p')[0].text.strip() == "Sending text messages is an invitation‑only feature."
+    assert page.select(".page-footer-back-link")[0].text == "Back to the template"
+    assert page.select(".page-footer-back-link")[0]['href'] == url_for(
+        '.view_template',
+        service_id=service_one['id'],
+        template_id=template_id,
+    )
+
+
 @pytest.mark.parametrize('template_mock, partial_url, expected_h1, tour_shown', [
     (
         mock_get_service_template_with_placeholders,
@@ -542,11 +594,15 @@ def test_send_test_redirects_to_start_if_index_out_of_bounds_and_some_placeholde
 ])
 def _redirects_with_help_argument(
     logged_in_client,
+    mocker,
     service_one,
     fake_uuid,
     endpoint,
     expected_redirect,
 ):
+    template = {'data': {'template_type': 'sms'}}
+    mocker.patch('app.service_api_client.get_service_template', return_value=template)
+
     response = logged_in_client.get(
         url_for(endpoint, service_id=service_one['id'], template_id=fake_uuid, help=1)
     )
@@ -848,6 +904,8 @@ def test_send_test_clears_session(
     service_one,
     fake_uuid,
 ):
+    template = {'data': {'template_type': 'sms'}}
+    mocker.patch('app.service_api_client.get_service_template', return_value=template)
 
     with logged_in_client.session_transaction() as session:
         session['recipient'] = '07700900001'

tests/app/main/views/test_templates.py

@@ -266,6 +266,64 @@ def test_dont_show_preview_letter_templates_for_bad_filetype(
     assert mock_get_service_template.called is False
 
 
+@pytest.mark.parametrize('type_of_template', ['email', 'sms'])
+def test_should_not_allow_creation_of_template_through_form_without_correct_permission(
+    logged_in_client,
+    service_one,
+    mocker,
+    type_of_template,
+):
+    service_one['permissions'] = []
+    template_description = {'sms': 'text messages', 'email': 'emails'}
+
+    response = logged_in_client.post(url_for(
+        '.add_template_by_type',
+        service_id=service_one['id']),
+        data={'template_type': type_of_template},
+        follow_redirects=True)
+
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+
+    assert response.status_code == 200
+    assert page.select('main p')[0].text.strip() == \
+        "Sending {} is an invitation‑only feature.".format(template_description[type_of_template])
+    assert page.select(".page-footer-back-link")[0].text == "Back to add new template"
+    assert page.select(".page-footer-back-link")[0]['href'] == url_for(
+        '.add_template_by_type',
+        service_id=service_one['id'],
+        template_id='0',
+    )
+
+
+@pytest.mark.parametrize('type_of_template', ['email', 'sms'])
+def test_should_not_allow_creation_of_a_template_without_correct_permission(
+    logged_in_client,
+    service_one,
+    mocker,
+    type_of_template,
+):
+    service_one['permissions'] = []
+    template_description = {'sms': 'text messages', 'email': 'emails'}
+
+    response = logged_in_client.get(url_for(
+        '.add_service_template',
+        service_id=service_one['id'],
+        template_type=type_of_template),
+        follow_redirects=True)
+
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+
+    assert response.status_code == 200
+    assert page.select('main p')[0].text.strip() == \
+        "Sending {} is an invitation‑only feature.".format(template_description[type_of_template])
+    assert page.select(".page-footer-back-link")[0].text == "Back to templates"
+    assert page.select(".page-footer-back-link")[0]['href'] == url_for(
+        '.choose_template',
+        service_id=service_one['id'],
+        template_id='0',
+    )
+
+
 def test_should_redirect_when_saving_a_template(
     logged_in_client,
     active_user_with_permissions,
@@ -336,6 +394,32 @@ def test_should_edit_content_when_process_type_is_priority_not_platform_admin(
     )
 
 
+def test_should_not_allow_template_edits_without_correct_permission(
+    logged_in_client,
+    mock_get_service_template,
+    service_one,
+    fake_uuid,
+):
+    template_id = fake_uuid
+    service_one['permissions'] = ['email']
+
+    response = logged_in_client.get(url_for(
+        '.edit_service_template',
+        service_id=service_one['id'],
+        template_id=template_id),
+        follow_redirects=True)
+    page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
+
+    assert response.status_code == 200
+    assert page.select('main p')[0].text.strip() == "Sending text messages is an invitation‑only feature."
+    assert page.select(".page-footer-back-link")[0].text == "Back to the template"
+    assert page.select(".page-footer-back-link")[0]['href'] == url_for(
+        '.view_template',
+        service_id=service_one['id'],
+        template_id=template_id,
+    )
+
+
 def test_should_403_when_edit_template_with_process_type_of_priority_for_non_platform_admin(
     client,
     active_user_with_permissions,