Test cancel request via API returns 404 if service id does not match

tests/app/conftest.py

@@ -183,6 +183,33 @@ def sample_broadcast_service(broadcast_organisation, sample_user):
     return service
 
 
+@pytest.fixture(scope='function')
+def sample_broadcast_service_2(broadcast_organisation, sample_user):
+    service_name = 'Sample broadcast service 2'
+    email_from = service_name.lower().replace(' ', '.')
+
+    data = {
+        'name': service_name,
+        'message_limit': 1000,
+        'restricted': False,
+        'email_from': email_from,
+        'created_by': sample_user,
+        'crown': True,
+        'count_as_live': False,
+    }
+    service = Service.query.filter_by(name=service_name).first()
+    if not service:
+        service = Service(**data)
+        dao_create_service(service, sample_user, service_permissions=[BROADCAST_TYPE])
+        insert_or_update_service_broadcast_settings(service, channel="severe")
+        dao_add_service_to_organisation(service, current_app.config['BROADCAST_ORGANISATION_ID'])
+    else:
+        if sample_user not in service.users:
+            dao_add_user_to_service(service, sample_user)
+
+    return service
+
+
 @pytest.fixture(scope='function', name='sample_service_full_permissions')
 def _sample_service_full_permissions(notify_db_session):
     service = create_service(

tests/app/v2/broadcast/test_post_broadcast.py

@@ -192,6 +192,39 @@ def test_cancel_request_does_not_cancel_broadcast_if_reference_does_not_match(
     assert response_for_cancel.status_code == 404
 
 
+def test_cancel_request_does_not_cancel_broadcast_if_service_id_does_not_match(
+    client,
+    sample_broadcast_service,
+    sample_broadcast_service_2
+):
+    auth_header = create_service_authorization_header(service_id=sample_broadcast_service.id)
+
+    # create a broadcast
+    response_for_create = client.post(
+        path='/v2/broadcast',
+        data=sample_cap_xml_documents.WAINFLEET,
+        headers=[('Content-Type', 'application/cap+xml'), auth_header],
+    )
+    assert response_for_create.status_code == 201
+
+    response_json_for_create = json.loads(response_for_create.get_data(as_text=True))
+
+    assert response_json_for_create['cancelled_at'] is None
+    assert response_json_for_create['cancelled_by_id'] is None
+    assert response_json_for_create['reference'] == '50385fcb0ab7aa447bbd46d848ce8466E'
+    assert response_json_for_create['status'] == 'pending-approval'
+
+    # try to cancel broadcast, but service id doesn't match
+    auth_header_2 = create_service_authorization_header(service_id=sample_broadcast_service_2.id)
+    response_for_cancel = client.post(
+        path='/v2/broadcast',
+        data=sample_cap_xml_documents.WAINFLEET_CANCEL,
+        headers=[('Content-Type', 'application/cap+xml'), auth_header_2],
+    )
+
+    assert response_for_cancel.status_code == 404
+
+
 def test_large_polygon_is_simplified(
     client,
     sample_broadcast_service,