Give better error messages for incorrect code

If we know the code won’t pass the validation on the API side, we might
as well tell the user before even passing it to the API.

So this commit:
- adds some more validators to the field
- rewrites the validation function on the form to actually call the
  field-level validators before hitting the API 🤦‍♂️
- refactors the tests to be parametrize, which means they can be
  shorter, easier to read, and more comprehensive

app/main/forms.py

@@ -161,11 +161,12 @@ def password(label='Password'):
 
 
 def sms_code():
-    verify_code = '^\d{5}$'
-    return StringField('Text message code',
-                       validators=[DataRequired(message='Can’t be empty'),
-                                   Regexp(regex=verify_code,
-                                          message='Code not found')])
+    return StringField('Text message code', validators=[
+        DataRequired(message='Can’t be empty'),
+        Regexp(regex='^\d+$', message='Numbers only'),
+        Length(min=5, message='Not enough numbers'),
+        Length(max=5, message='Too many numbers'),
+    ])
 
 
 def organisation_type():
@@ -317,10 +318,18 @@ class TwoFactorForm(StripWhitespaceForm):
 
     sms_code = sms_code()
 
-    def validate_sms_code(self, field):
-        is_valid, reason = self.validate_code_func(field.data)
+    def validate(self):
+
+        if not self.sms_code.validate(self):
+            return False
+
+        is_valid, reason = self.validate_code_func(self.sms_code.data)
+
         if not is_valid:
-            raise ValidationError(reason)
+            self.sms_code.errors.append(reason)
+            return False
+
+        return True
 
 
 class EmailNotReceivedForm(StripWhitespaceForm):