From c8e85efd54acf6da66754dc18338077ace3976f0 Mon Sep 17 00:00:00 2001
From: Chris Hill-Scott <me@quis.cc>
Date: Mon, 5 Oct 2020 17:17:21 +0100
Subject: [PATCH] =?UTF-8?q?Don=E2=80=99t=20allow=20personalisation=20in=20?=
 =?UTF-8?q?broadcast=20templates?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since we don’t have a way of filling in the personalisation at the
moment we shouldn’t allow people to make templates that require it.
---
 app/main/forms.py                      |  2 ++
 app/main/validators.py                 | 12 +++++++++
 tests/app/main/views/test_templates.py | 37 ++++++++++++++++++++++++++
 3 files changed, 51 insertions(+)

diff --git a/app/main/forms.py b/app/main/forms.py
index eeb90fe0f..5b0f74f4d 100644
--- a/app/main/forms.py
+++ b/app/main/forms.py
@@ -47,6 +47,7 @@ from app.main.validators import (
     MustContainAlphanumericCharacters,
     NoCommasInPlaceHolders,
     NoEmbeddedImagesInSVG,
+    NoPlaceholders,
     OnlySMSCharacters,
     ValidEmail,
     ValidGovEmail,
@@ -1217,6 +1218,7 @@ class SMSTemplateForm(BaseTemplateForm):
 class BroadcastTemplateForm(SMSTemplateForm):
     def validate_template_content(self, field):
         OnlySMSCharacters(template_type='broadcast')(None, field)
+        NoPlaceholders()(None, field)
 
 
 class LetterAddressForm(StripWhitespaceForm):
diff --git a/app/main/validators.py b/app/main/validators.py
index 9434c39c4..104b4a932 100644
--- a/app/main/validators.py
+++ b/app/main/validators.py
@@ -108,6 +108,18 @@ class OnlySMSCharacters:
             )
 
 
+class NoPlaceholders:
+
+    def __init__(self, message=None):
+        self.message = message or (
+            'You can’t use ((double brackets)) to personalise this message'
+        )
+
+    def __call__(self, form, field):
+        if Field(field.data).placeholders:
+            raise ValidationError(self.message)
+
+
 class LettersNumbersFullStopsAndUnderscoresOnly:
 
     regex = re.compile(r'^[a-zA-Z0-9\s\._]+$')
diff --git a/tests/app/main/views/test_templates.py b/tests/app/main/views/test_templates.py
index a69c1a58e..27233383f 100644
--- a/tests/app/main/views/test_templates.py
+++ b/tests/app/main/views/test_templates.py
@@ -2389,3 +2389,40 @@ def test_set_template_sender_escapes_letter_contact_block_names(
     radio_text = page.select_one('.govuk-grid-column-three-quarters label[for="sender-1"]').decode_contents()
     assert "&lt;script&gt;" in radio_text
     assert "<script>" not in radio_text
+
+
+@pytest.mark.parametrize('template_content', (
+    'This is a ((test))',
+    'This ((unsure??might)) be a test',
+    pytest.param('This is a test', marks=pytest.mark.xfail),
+))
+@pytest.mark.parametrize('template_type', (
+    'broadcast',
+    pytest.param('sms', marks=pytest.mark.xfail),
+))
+def test_should_not_create_broadcast_template_with_placeholders(
+    client_request,
+    service_one,
+    mock_create_service_template,
+    mock_update_service_template,
+    template_content,
+    template_type,
+):
+    service_one['permissions'] += [template_type]
+    page = client_request.post(
+        '.add_service_template',
+        service_id=SERVICE_ONE_ID,
+        template_type=template_type,
+        _data={
+            'name': 'new name',
+            'template_content': template_content,
+            'service': SERVICE_ONE_ID,
+        },
+        _expected_status=200,
+    )
+    assert normalize_spaces(
+        page.select_one('.error-message').text
+    ) == (
+        'You can’t use ((double brackets)) to personalise this message'
+    )
+    assert mock_create_service_template.called is False