Merge pull request #5662 from nhsuk/mmr-consent-form-download

Fix label for MMR consent form download

Author: thomasleese

app/components/app_session_summary_component.rb

@@ -174,10 +174,9 @@ def online_consent_links
 
   def download_consent_links
     session.programmes.map do |programme|
-      link_to(
-        "Download the #{programme.name} consent form (PDF)",
-        consent_form_programme_path(programme)
-      )
+      name = I18n.t(programme.type, scope: :programme_types)
+      label = "Download the #{name} consent form (PDF)"
+      link_to(label, consent_form_programme_path(programme))
     end
   end
 

app/controllers/programmes_controller.rb

@@ -9,14 +9,17 @@ def index
     @programmes = current_user.programmes
   end
 
+  CONSENT_FORM_TYPES = %w[flu hpv menacwy mmr td_ipv].freeze
+
   def consent_form
-    programme =
-      authorize(current_user.programmes.find { it.type == params[:type] })
-
-    send_file(
-      "public/consent_forms/#{programme.type}.pdf",
-      filename: "#{programme.name} Consent Form.pdf",
-      disposition: "attachment"
-    )
+    type = params[:type]
+
+    raise ActiveRecord::RecordNotFound unless CONSENT_FORM_TYPES.include?(type)
+
+    path = "public/consent_forms/#{type}.pdf"
+    name = I18n.t(type, scope: :programme_types)
+    filename = "#{name} Consent Form.pdf"
+
+    send_file(path, filename:, disposition: "attachment")
   end
 end

app/models/programme/variant.rb

@@ -45,9 +45,15 @@ def vaccines
     @vaccines ||= Vaccine.for_programme(self)
   end
 
-  def snomed_target_disease_codes = SNOMED_TARGET_DISEASE_CODES.fetch(type)
+  def snomed_target_disease_codes
+    SNOMED_TARGET_DISEASE_CODES.fetch(variant_type)
+  end
 
-  def snomed_target_disease_terms = SNOMED_TARGET_DISEASE_TERMS.fetch(type)
+  def snomed_target_disease_terms
+    SNOMED_TARGET_DISEASE_TERMS.fetch(variant_type)
+  end
 
-  def snomed_target_disease_name = SNOMED_TARGET_DISEASE_NAMES.fetch(type)
+  def snomed_target_disease_name
+    SNOMED_TARGET_DISEASE_NAMES.fetch(variant_type)
+  end
 end

app/policies/programme_policy.rb

@@ -4,6 +4,4 @@ class ProgrammePolicy < ApplicationPolicy
   def sessions? = index?
 
   def patients = index?
-
-  def consent_form? = show?
 end

config/brakeman.ignore

@@ -1,28 +1,4 @@
 {
-  "ignored_warnings": [
-    {
-      "warning_type": "File Access",
-      "warning_code": 16,
-      "fingerprint": "d1c86d018389c98f1e79ce464b868fda33c00e382a08bd1eee9d678f2480e7fc",
-      "check_name": "SendFile",
-      "message": "Model attribute used in file name",
-      "file": "app/controllers/programmes_controller.rb",
-      "line": 14,
-      "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
-      "code": "send_file(\"public/consent_forms/#{authorize(current_user.programmes.find do\n (it.type == params[:type])\n end).type}.pdf\", :filename => (\"#{authorize(current_user.programmes.find do\n (it.type == params[:type])\n end).name} Consent Form.pdf\"), :disposition => \"attachment\")",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "ProgrammesController",
-        "method": "consent_form"
-      },
-      "user_input": "current_user.programmes.find",
-      "confidence": "Weak",
-      "cwe_id": [
-        22
-      ],
-      "note": "Programme names/types come from a limited set of enums."
-    }
-  ],
+  "ignored_warnings": [],
   "brakeman_version": "7.1.1"
 }

spec/components/app_session_summary_component_spec.rb

@@ -49,5 +49,13 @@
         )
       end
     end
+
+    context "for MMR(V) programme" do
+      before { Flipper.enable(:mmrv) }
+
+      let(:programmes) { [Programme.mmr] }
+
+      it { should have_link("Download the MMR consent form (PDF)") }
+    end
   end
 end

spec/requests/programmes_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+describe "Programmes" do
+  let(:team) { create(:team) }
+  let(:nurse) { create(:nurse, teams: [team]) }
+
+  describe "downloading consent form" do
+    let(:path) { "/programmes/mmr/consent-form" }
+
+    before do
+      sign_in nurse
+      2.times { follow_redirect! }
+    end
+
+    it "downloads a PDF file with a suitable filename" do
+      get path
+      expect(response.headers["Content-Type"]).to eq("application/pdf")
+      expect(response.headers["Content-Disposition"]).to include(
+        "filename=\"MMR Consent Form.pdf\""
+      )
+    end
+  end
+end