Add folder permission check to copy template endpoint

Copying a template from another service is one place where we can't
use the `current_service` method since the source template can belong
to a different service the user has access to, so we're using an API
client method.

app/main/views/templates.py

@@ -379,6 +379,13 @@ def copy_template(service_id, template_id):
         str(template_id),
     )['data']
 
+    template_folder = template_folder_api_client.get_template_folder(service_id, template['folder'])
+    if (
+        current_service.has_permission('edit_folder_permissions') and
+        not current_user.has_template_folder_permission(template_folder)
+    ):
+        abort(403)
+
     if request.method == 'POST':
         return add_service_template(service_id, template['template_type'])
 

app/notify_client/template_folder_api_client.py

@@ -21,6 +21,19 @@ class TemplateFolderAPIClient(NotifyAdminAPIClient):
     def get_template_folders(self, service_id):
         return self.get('/service/{}/template-folder'.format(service_id))['template_folders']
 
+    def get_template_folder(self, service_id, folder_id):
+        if folder_id is None:
+            return {
+                'id': None,
+                'name': 'Templates',
+                'parent_id': None,
+            }
+        else:
+            return next(
+                folder for folder in self.get_template_folders(service_id)
+                if folder['id'] == str(folder_id)
+            )
+
     @cache.delete('service-{service_id}-template-folders')
     @cache.delete('service-{service_id}-templates')
     def move_to_folder(self, service_id, folder_id, template_ids, folder_ids):