From 402991eb68be2399c3db7741a0a1269198005f92 Mon Sep 17 00:00:00 2001
From: Henry Cooksley <henry.cooksley@digital.trade.gov.uk>
Date: Tue, 6 Feb 2024 16:33:22 +0000
Subject: [PATCH] Update view so govuser cannot close query with blank response

---
 api/cases/tests/test_case_ecju_queries.py | 15 +++++----------
 api/cases/views/views.py                  | 10 +++++++++-
 2 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/api/cases/tests/test_case_ecju_queries.py b/api/cases/tests/test_case_ecju_queries.py
index 78c74cb934..b4d94495ff 100644
--- a/api/cases/tests/test_case_ecju_queries.py
+++ b/api/cases/tests/test_case_ecju_queries.py
@@ -522,7 +522,8 @@ def test_close_query_has_optional_response_exporter(self):
         self.assertIsNone(response_ecju_query["response"])
         self.assertIsNotNone(response_ecju_query["responded_at"])
 
-    def test_close_query_has_optional_response_govuser(self):
+    @parameterized.expand(["", None])
+    def test_close_query_has_required_response_govuser(self, response_value):
         case = self.create_standard_application_case(self.organisation)
         ecju_query = self.create_ecju_query(case, question="provide details please", gov_user=self.gov_user)
 
@@ -530,17 +531,11 @@ def test_close_query_has_optional_response_govuser(self):
 
         query_response_url = reverse("cases:case_ecju_query", kwargs={"pk": case.id, "ecju_pk": ecju_query.id})
 
-        data = {"response": ""}
+        data = {"response": response_value}
 
         response = self.client.put(query_response_url, data, **self.gov_headers)
-        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
-
-        response_ecju_query = response.json()["ecju_query"]
-        self.assertIsNone(response_ecju_query["response"])
-        self.assertIsNotNone(response_ecju_query["responded_at"])
-
-        response_get = self.client.get(query_response_url, **self.gov_headers)
-        self.assertEqual(True, response_get.json()["ecju_query"]["is_manually_closed"])
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertEqual(response.json()["errors"], "Enter a reason why you are closing the query")
 
     def test_caseworker_manually_closes_query_exporter_responds_raises_error(self):
         case = self.create_standard_application_case(self.organisation)
diff --git a/api/cases/views/views.py b/api/cases/views/views.py
index fc2b60aa06..16e3b7dd78 100644
--- a/api/cases/views/views.py
+++ b/api/cases/views/views.py
@@ -622,6 +622,15 @@ def put(self, request, pk, ecju_pk):
                 status=status.HTTP_400_BAD_REQUEST,
             )
 
+        is_govuser = hasattr(request.user, "govuser")
+        is_blank_response = not bool(request.data.get("response"))
+
+        # response is required only when a govuser closes a query
+        if is_govuser and is_blank_response:
+            return JsonResponse(
+                data={"errors": "Enter a reason why you are closing the query"}, status=status.HTTP_400_BAD_REQUEST
+            )
+
         data = {"responded_by_user": str(request.user.pk)}
 
         if request.data.get("response"):
@@ -632,7 +641,6 @@ def put(self, request, pk, ecju_pk):
         if serializer.is_valid():
             if "validate_only" not in request.data or not request.data["validate_only"]:
                 serializer.save()
-                is_govuser = hasattr(request.user, "govuser")
                 # If the user is a Govuser query is manually being closed by a caseworker
                 query_verb = AuditType.ECJU_QUERY_MANUALLY_CLOSED if is_govuser else AuditType.ECJU_QUERY_RESPONSE
                 audit_trail_service.create(