Redirect from confirmation page if session empty

app/main/views/manage_users.py

@@ -164,7 +164,14 @@ def edit_user_email(service_id, user_id):
 @user_has_permissions('manage_service')
 def confirm_edit_user_email(service_id, user_id):
     user = user_api_client.get_user(user_id)
-    new_email = session['team_member_email_change']
+    if 'team_member_email_change' in session:
+        new_email = session['team_member_email_change']
+    else:
+        return redirect(url_for(
+            '.edit_user_email',
+            service_id=service_id,
+            user_id=user_id
+        ))
     if request.method == 'POST':
         try:
             user_api_client.update_user_attribute(user_id, email_address=new_email)

tests/app/main/views/test_manage_users.py

@@ -840,6 +840,22 @@ def test_confirm_edit_user_email_page(
     assert response.status_code == 200
 
 
+def test_confirm_edit_user_email_page_redirects_if_session_empty(
+    logged_in_client,
+    active_user_with_permissions,
+    service_one,
+    mocker,
+    mock_get_user,
+):
+    response = logged_in_client.get(url_for(
+        'main.confirm_edit_user_email',
+        service_id=service_one['id'],
+        user_id=active_user_with_permissions.id
+    ))
+    assert response.status_code == 302
+    assert 'Confirm change of email address' not in response.get_data(as_text=True)
+
+
 def test_confirm_edit_user_email_changes_user_email(
     logged_in_client,
     active_user_with_permissions,