From a8ebb10c8e140e0f369dd9925bc0eb2d8e597928 Mon Sep 17 00:00:00 2001
From: Leo Hemsted <leo.hemsted@digital.cabinet-office.gov.uk>
Date: Mon, 6 Nov 2017 16:46:53 +0000
Subject: [PATCH] add tests for code used

---
 tests/app/user/test_rest_verify.py | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/tests/app/user/test_rest_verify.py b/tests/app/user/test_rest_verify.py
index a84a1a72a..e41dacc2c 100644
--- a/tests/app/user/test_rest_verify.py
+++ b/tests/app/user/test_rest_verify.py
@@ -15,7 +15,8 @@ from app.models import (
     VerifyCode,
     User,
     Notification,
-    EMAIL_TYPE
+    EMAIL_TYPE,
+    SMS_TYPE
 )
 from app import db
 import app.celery.tasks
@@ -409,3 +410,27 @@ def test_user_verify_email_code(admin_request, sample_user):
     assert verify_code.code_used
     assert sample_user.logged_in_at == datetime.utcnow()
     assert sample_user.current_session_id is not None
+
+
+@pytest.mark.parametrize('code_type', [EMAIL_TYPE, SMS_TYPE])
+@freeze_time('2016-01-01T12:00:00')
+def test_user_verify_email_code_fails_if_code_already_used(admin_request, sample_user, code_type):
+    magic_code = str(uuid.uuid4())
+    verify_code = create_user_code(sample_user, magic_code, code_type)
+    verify_code.code_used = True
+
+    data = {
+        'code_type': code_type,
+        'code': magic_code
+    }
+
+    admin_request.post(
+        'user.verify_user_code',
+        user_id=sample_user.id,
+        _data=data,
+        _expected_status=400
+    )
+
+    assert verify_code.code_used
+    assert sample_user.logged_in_at is None
+    assert sample_user.current_session_id is None