Return 404 instead of 403 for request replays and discarded domains

Gemfile

@@ -1,14 +1,14 @@
 source 'https://rubygems.org'
 
+gem 'figaro', '~> 1.1.0'
 gem 'jbuilder'
 gem 'pg', '~> 0.19.0'
 gem 'rails', '~> 4.2.7.1'
 gem 'recaptcha', require: 'recaptcha/rails'
+gem 'sass-rails'
 gem 'simpleidn', '0.0.7' # For Punycode
 gem 'SyslogLogger', '2.0', require: 'syslog/logger'
-gem 'sass-rails'
 gem 'uglifier'
-gem 'figaro', '~> 1.1.0'
 
 group :development, :test do
   gem 'pry'

app/controllers/contact_requests_controller.rb

@@ -5,8 +5,7 @@ class ContactRequestsController < ApplicationController
 
   def new
     whois_record = WhoisRecord.find_by!(name: params[:domain_name])
-    return head(:forbidden) unless whois_record.contactable?
-
+    raise ActiveRecord::RecordNotFound unless whois_record.contactable?
     @contact_request = ContactRequest.new(whois_record: whois_record)
   end
 
@@ -56,7 +55,8 @@ def set_ip_address
   end
 
   def check_for_replay
-    return head(:forbidden) if @contact_request.completed_or_expired?
+    return unless @contact_request.completed_or_expired?
+    raise ActiveRecord::RecordNotFound
   end
 
   def contact_request_params

app/models/whois_record.rb

@@ -22,7 +22,7 @@ def contactable?
   private
 
   def discarded_blocked_or_reserved?
-    !(([BLOCKED, RESERVED, DISCARDED] & json['status']).empty?)
+    !([BLOCKED, RESERVED, DISCARDED] & json['status']).empty?
   end
 
   def partial_for_private_person(authorized)

test/integration/contact_requests_confirmation_test.rb

@@ -40,9 +40,10 @@ def test_link_from_whois_record_page_does_not_exists_for_discarded_domains
   end
 
   def test_new_request_fails_if_that_is_a_discarded_domain
-    visit(new_contact_request_path(params: { domain_name: 'discarded-domain.test' }))
-    assert_equal(403, page.status_code)
-    assert(page.body.empty?)
+    assert_raise ActiveRecord::RecordNotFound do
+      visit(new_contact_request_path(params: { domain_name: 'discarded-domain.test' }))
+      assert_equal(404, page.status_code)
+    end
   end
 
   def test_link_from_whois_record_page_does_not_exists_for_legal_owners
@@ -51,15 +52,17 @@ def test_link_from_whois_record_page_does_not_exists_for_legal_owners
   end
 
   def test_new_request_fails_if_that_is_not_a_private_domain
-    visit(new_contact_request_path(params: { domain_name: 'company-domain.test' }))
-    assert_equal(403, page.status_code)
-    assert(page.body.empty?)
+    assert_raise ActiveRecord::RecordNotFound do
+      visit(new_contact_request_path(params: { domain_name: 'company-domain.test' }))
+      assert_equal(404, page.status_code)
+    end
   end
 
-  def test_expired_contact_request_returns_403_with_empty_body
-    visit(contact_request_path(@expired_contact_request.secret))
-    assert_equal(403, page.status_code)
-    assert(page.body.empty?)
+  def test_expired_contact_request_fails
+    assert_raise ActiveRecord::RecordNotFound do
+      visit(contact_request_path(@expired_contact_request.secret))
+      assert_equal(404, page.status_code)
+    end
   end
 
   def test_create_a_email_confirmation_delivery

test/integration/contact_requests_test.rb

@@ -39,7 +39,7 @@ def test_create_an_contact_email_delivery
     assert_match(expected_disclaimer, friendly_mail_body)
   end
 
-  def test_request_replay_returns_403
+  def test_request_replay_fails
     # Visit the page once
     visit(contact_request_path(@valid_contact_request.secret))
 
@@ -50,9 +50,10 @@ def test_request_replay_returns_403
     assert_text('Your email has been sent.') # Successfully send an email
 
     # Visit the page again, and get an error code
-    visit(contact_request_path(@valid_contact_request.secret))
-    assert_equal(403, page.status_code)
-    assert(page.body.empty?)
+    assert_raise ActiveRecord::RecordNotFound do
+      visit(contact_request_path(@valid_contact_request.secret))
+      assert_equal(404, page.status_code)
+    end
   end
 
   # Locale tests start here