From 70eec8fe7316cd32702b2e3d0216e10285ca7165 Mon Sep 17 00:00:00 2001
From: Chris Hill-Scott <me@quis.cc>
Date: Tue, 8 Nov 2016 13:10:38 +0000
Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20let=20people=20actually=20start?=
 =?UTF-8?q?=20a=20letter=20job?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Who knows what would happen if a job with a letter template actually
got into the database. `403`ing the page is a quick and dirty hack to
stop this from happening.
---
 app/main/views/send.py            |  8 ++++++++
 tests/app/main/views/test_send.py | 27 +++++++++++++++++++++++++++
 tests/conftest.py                 | 15 +++++++++++++++
 3 files changed, 50 insertions(+)

diff --git a/app/main/views/send.py b/app/main/views/send.py
index d79fbc194..b240512ed 100644
--- a/app/main/views/send.py
+++ b/app/main/views/send.py
@@ -310,6 +310,14 @@ def start_job(service_id, upload_id):
 
     session.pop('upload_data')
 
+    template = service_api_client.get_service_template(
+        service_id,
+        upload_data.get('template_id')
+    )['data']
+
+    if template['template_type'] == 'letter':
+        abort(403)
+
     job_api_client.create_job(
         upload_id,
         service_id,
diff --git a/tests/app/main/views/test_send.py b/tests/app/main/views/test_send.py
index 5c7736972..f3a339cae 100644
--- a/tests/app/main/views/test_send.py
+++ b/tests/app/main/views/test_send.py
@@ -405,6 +405,33 @@ def test_create_job_should_call_api(
     )
 
 
+def test_cant_start_letters_job(
+    app_,
+    client,
+    service_one,
+    mock_get_service,
+    active_user_with_permissions,
+    mock_create_job,
+    mock_get_service_letter_template,
+    mocker,
+    fake_uuid
+):
+    client.login(active_user_with_permissions, mocker, service_one)
+    with client.session_transaction() as session:
+        session['upload_data'] = {
+            'original_file_name': 'example.csv',
+            'template_id': fake_uuid,
+            'notification_count': 123,
+            'valid': True
+        }
+    response = client.post(
+        url_for('main.start_job', service_id=fake_uuid, upload_id=fake_uuid),
+        data={}
+    )
+    assert response.status_code == 403
+    mock_create_job.assert_not_called()
+
+
 def test_check_messages_should_revalidate_file_when_uploading_file(
     app_,
     service_one,
diff --git a/tests/conftest.py b/tests/conftest.py
index d526b06e6..e9f7cc8f9 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -335,6 +335,21 @@ def mock_get_service_email_template(mocker):
         'app.service_api_client.get_service_template', side_effect=_create)
 
 
+@pytest.fixture(scope='function')
+def mock_get_service_letter_template(mocker):
+    def _create(service_id, template_id):
+        template = template_json(
+            service_id,
+            template_id,
+            "Two week reminder",
+            "letter",
+            "Your vehicle tax is about to expire", "Subject")
+        return {'data': template}
+
+    return mocker.patch(
+        'app.service_api_client.get_service_template', side_effect=_create)
+
+
 @pytest.fixture(scope='function')
 def mock_create_service_template(mocker, fake_uuid):
     def _create(name, type_, content, service, subject=None):