wip

Author: kpethtel

app/controllers/v0/tsa_letter_controller.rb

@@ -30,7 +30,9 @@ def download
       user_owns_file = files_metadata.any? do |file|
         params[:id] == file['uuid'] && params[:version_id] == file['currentVersionUuid']
       end
-      raise Common::Exceptions::Unauthorized unless user_owns_file
+      unless user_owns_file
+        raise Common::Exceptions::BadRequest, detail: "User #{current_user.user_account_uuid} does not own file."
+      end
 
       download_service = ClaimsEvidenceApi::Service::Files.new
       letter_response = download_service.download(params[:id], params[:version_id])

spec/requests/v0/tsa_letter_spec.rb

@@ -168,21 +168,21 @@
     end
 
     context 'when requested letter does not belong to user' do
-      it 'returns some sort of error' do
+      it 'returns bad request' do
         VCR.use_cassette('tsa_letters/show_success', { match_requests_on: %i[method uri body] }) do
           document_id = 'fake'
           version_id = 'phony'
           get "/v0/tsa_letter/#{document_id}/version/#{version_id}/download"
-          expect(response).to have_http_status(:unauthorized)
+          expect(response).to have_http_status(:bad_request)
         end
       end
     end
 
     context 'when metadata fetch fails' do
-      it 'raises the matching error class' do
+      it 'raises service unavailable' do
         VCR.use_cassette('tsa_letters/show_bad_request', { match_requests_on: %i[method uri body] }) do
           get "/v0/tsa_letter/#{document_id}/version/#{version_id}/download"
-          expect(response).to have_http_status(:bad_request)
+          expect(response).to have_http_status(:service_unavailable)
         end
       end
     end