Fix label for MMR consent form download

This ensures that we use the "MMR" label and not "MMR(V)" as the consent
form is specific to the MMR variant and cannot be used for MMRV.

I've also refactored the code related to downloading consent forms to
make it simpler.

Jira-Issue: MAV-2963

Author: thomasleese

app/components/app_session_summary_component.rb

@@ -174,10 +174,9 @@ def online_consent_links
 
   def download_consent_links
     session.programmes.map do |programme|
-      link_to(
-        "Download the #{programme.name} consent form (PDF)",
-        consent_form_programme_path(programme)
-      )
+      name = I18n.t(programme.type, scope: :programme_types)
+      label = "Download the #{name} consent form (PDF)"
+      link_to(label, consent_form_programme_path(programme))
     end
   end
 

app/controllers/programmes_controller.rb

@@ -9,14 +9,17 @@ def index
     @programmes = current_user.programmes
   end
 
+  CONSENT_FORM_TYPES = %w[flu hpv menacwy mmr td_ipv].freeze
+
   def consent_form
-    programme =
-      authorize(current_user.programmes.find { it.type == params[:type] })
-
-    send_file(
-      "public/consent_forms/#{programme.type}.pdf",
-      filename: "#{programme.name} Consent Form.pdf",
-      disposition: "attachment"
-    )
+    type = params[:type]
+
+    raise ActiveRecord::RecordNotFound unless CONSENT_FORM_TYPES.include?(type)
+
+    path = "public/consent_forms/#{type}.pdf"
+    name = I18n.t(type, scope: :programme_types)
+    filename = "#{name} Consent Form.pdf"
+
+    send_file(path, filename:, disposition: "attachment")
   end
 end

app/policies/programme_policy.rb

@@ -4,6 +4,4 @@ class ProgrammePolicy < ApplicationPolicy
   def sessions? = index?
 
   def patients = index?
-
-  def consent_form? = show?
 end

config/brakeman.ignore

@@ -1,28 +1,4 @@
 {
-  "ignored_warnings": [
-    {
-      "warning_type": "File Access",
-      "warning_code": 16,
-      "fingerprint": "d1c86d018389c98f1e79ce464b868fda33c00e382a08bd1eee9d678f2480e7fc",
-      "check_name": "SendFile",
-      "message": "Model attribute used in file name",
-      "file": "app/controllers/programmes_controller.rb",
-      "line": 14,
-      "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
-      "code": "send_file(\"public/consent_forms/#{authorize(current_user.programmes.find do\n (it.type == params[:type])\n end).type}.pdf\", :filename => (\"#{authorize(current_user.programmes.find do\n (it.type == params[:type])\n end).name} Consent Form.pdf\"), :disposition => \"attachment\")",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "ProgrammesController",
-        "method": "consent_form"
-      },
-      "user_input": "current_user.programmes.find",
-      "confidence": "Weak",
-      "cwe_id": [
-        22
-      ],
-      "note": "Programme names/types come from a limited set of enums."
-    }
-  ],
+  "ignored_warnings": [],
   "brakeman_version": "7.1.1"
 }

spec/components/app_session_summary_component_spec.rb

@@ -49,5 +49,13 @@
         )
       end
     end
+
+    context "for MMR(V) programme" do
+      before { Flipper.enable(:mmrv) }
+
+      let(:programmes) { [Programme.mmr] }
+
+      it { should have_link("Download the MMR consent form (PDF)") }
+    end
   end
 end

spec/requests/programmes_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+describe "Programmes" do
+  let(:team) { create(:team) }
+  let(:nurse) { create(:nurse, teams: [team]) }
+
+  describe "downloading consent form" do
+    let(:path) { "/programmes/mmr/consent-form" }
+
+    before do
+      sign_in nurse
+      2.times { follow_redirect! }
+    end
+
+    it "downloads a PDF file with a suitable filename" do
+      get path
+      expect(response.headers["Content-Type"]).to eq("application/pdf")
+      expect(response.headers["Content-Disposition"]).to include(
+        "filename=\"MMR Consent Form.pdf\""
+      )
+    end
+  end
+end