Make allowed notification types explicit in search

By not having a catch-all else, it makes it clearer what we’re
expecting. And then we think it’s worth adding a comment explaining why
we normalise as we do for letters and the `None` case.

app/dao/notifications_dao.py

@@ -599,9 +599,20 @@ def dao_get_notifications_by_recipient_or_reference(service_id, search_term, not
         except InvalidEmailError:
             normalised = search_term.lower()
 
-    else:
+    elif notification_type in {LETTER_TYPE, None}:
+        # For letters, we store the address without spaces, so we need
+        # to removes spaces from the search term to match. We also do
+        # this when a notification type isn’t provided (this will
+        # happen if a user doesn’t have permission to see the dashboard)
+        # because email addresses and phone numbers will never be stored
+        # with spaces either.
         normalised = ''.join(search_term.split()).lower()
 
+    else:
+        raise TypeError(
+            f'Notification type must be {EMAIL_TYPE}, {SMS_TYPE}, {LETTER_TYPE} or None'
+        )
+
     normalised = escape_special_characters(normalised)
     search_term = escape_special_characters(search_term)