add broadcast message status transition map

be explicit about which transitions we allow. this is not necessarily an exhaustive list of everything we'll allow

app/broadcast_message/rest.py

@@ -41,16 +41,21 @@ def _update_broadcast_message(broadcast_message, new_status, updating_user):
     if updating_user not in broadcast_message.service.users:
         abort(
             400,
-            f'User {updating_user.id} cannot approve broadcast {broadcast_message.id} from other service'
+            f'User {updating_user.id} cannot approve broadcast_message {broadcast_message.id} from other service'
+        )
+
+    if new_status not in BroadcastStatusType.ALLOWED_STATUS_TRANSITIONS[broadcast_message.status]:
+        abort(
+            400,
+            f'Cannot move broadcast_message {broadcast_message.id} from {broadcast_message.status} to {new_status}'
         )
 
-    # TODO: Restrict status transitions
     if new_status == BroadcastStatusType.BROADCASTING:
         # TODO: Remove this platform admin shortcut when the feature goes live
         if updating_user == broadcast_message.created_by and not updating_user.platform_admin:
             abort(
                 400,
-                f'User {updating_user.id} cannot approve their own broadcast {broadcast_message.id}'
+                f'User {updating_user.id} cannot approve their own broadcast_message {broadcast_message.id}'
             )
         else:
             broadcast_message.approved_at = datetime.utcnow()

app/models.py

@@ -2176,6 +2176,17 @@ class BroadcastStatusType(db.Model):
     PRE_BROADCAST_STATUSES = [DRAFT, PENDING_APPROVAL, REJECTED]
     LIVE_STATUSES = [BROADCASTING, COMPLETED, CANCELLED]
 
+    # these are only the transitions we expect to administer via the API code.
+    ALLOWED_STATUS_TRANSITIONS = {
+        DRAFT: {PENDING_APPROVAL},
+        PENDING_APPROVAL: {REJECTED, DRAFT, BROADCASTING},
+        REJECTED: {DRAFT, PENDING_APPROVAL},
+        BROADCASTING: {COMPLETED, CANCELLED},
+        COMPLETED: {},
+        CANCELLED: {},
+        TECHNICAL_FAILURE: {},
+    }
+
     name = db.Column(db.String, primary_key=True)