From c1f67514a21c60eb4bd988e18620ebe8e489cc0a Mon Sep 17 00:00:00 2001
From: David McDonald <david.mcdonald@digital.cabinet-office.gov.uk>
Date: Fri, 2 Oct 2020 13:52:37 +0100
Subject: [PATCH] 404 for step-0

---
 app/main/views/tour.py            |  2 +-
 tests/app/main/views/test_tour.py | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/app/main/views/tour.py b/app/main/views/tour.py
index 4a29a667a..d6223a0e8 100644
--- a/app/main/views/tour.py
+++ b/app/main/views/tour.py
@@ -46,7 +46,7 @@ def begin_tour(service_id, template_id):
 def tour_step(service_id, template_id, step_index):
     db_template = current_service.get_template_with_user_permission_or_403(template_id, current_user)
 
-    if db_template['template_type'] != 'sms':
+    if (db_template['template_type'] != 'sms' or step_index == 0):
         abort(404)
 
     if 'placeholders' not in session:
diff --git a/tests/app/main/views/test_tour.py b/tests/app/main/views/test_tour.py
index 9375593b4..39a89364e 100644
--- a/tests/app/main/views/test_tour.py
+++ b/tests/app/main/views/test_tour.py
@@ -206,6 +206,24 @@ def test_should_404_if_non_sms_template_for_tour_step(
     )
 
 
+def test_should_404_for_get_tour_step_0(
+    client_request,
+    mock_get_service_template_with_multiple_placeholders,
+    service_one,
+    fake_uuid,
+):
+    with client_request.session_transaction() as session:
+        session['placeholders'] = {}
+
+    client_request.get(
+        'main.tour_step',
+        service_id=SERVICE_ONE_ID,
+        template_id=fake_uuid,
+        step_index=0,
+        _expected_status=404
+    )
+
+
 @pytest.mark.parametrize('method', ['GET', 'POST'])
 def test_should_403_if_user_does_not_have_send_permissions_for_tour_step(
     mocker,