Add ability to download paper consent forms

This adds the ability to download a paper consent form for all sessions
that are open, for now this is the same form for all HPV sessions, but
we can expect to customise this in the future to automatically include
the name of the school, etc.

I took the consent form PDF from the prototype, I notice that the health
questions are slightly different to the three we ask in the service,
there's an additional one about any special needs the patient might
require.

app/controllers/sessions_controller.rb

@@ -66,6 +66,16 @@ def update_close
     redirect_to session_path(@session), flash: { success: "Session closed." }
   end
 
+  def consent_form
+    programme = @session.programmes.first # TODO: handle multiple programmes
+
+    send_file(
+      "public/consent_forms/#{programme.type}.pdf",
+      filename: "#{programme.name} Consent Form.pdf",
+      disposition: "attachment"
+    )
+  end
+
   def make_in_progress
     @session.dates.find_or_create_by!(value: Date.current)
 

app/views/sessions/show.html.erb

@@ -18,6 +18,12 @@
     <%= session_status_tag(@session) %>
   </li>
 
+  <% if @session.open? %>
+    <li class="app-action-list__item">
+      <%= govuk_link_to "Download consent form (PDF)", consent_form_session_path(@session) %>
+    </li>
+  <% end %>
+
   <% if @session.open? && @session.location.school? %>
     <li class="app-action-list__item">
       <%= govuk_link_to "Import class list", new_session_class_import_path(@session) %>

config/brakeman.ignore

@@ -0,0 +1,29 @@
+{
+  "ignored_warnings": [
+    {
+      "warning_type": "File Access",
+      "warning_code": 16,
+      "fingerprint": "25619a87718cc1eff74221288fbf4d6826ba182664ada813ecd280bd3d32549f",
+      "check_name": "SendFile",
+      "message": "Parameter value used in file name",
+      "file": "app/controllers/sessions_controller.rb",
+      "line": 73,
+      "link": "https://brakemanscanner.org/docs/warning_types/file_access/",
+      "code": "send_file(\"public/consent_forms/#{sessions_scope.find(params[:id]).programmes.first.type}.pdf\", :filename => (\"#{sessions_scope.find(params[:id]).programmes.first.name} Consent Form.pdf\"), :disposition => \"attachment\")",
+      "render_path": null,
+      "location": {
+        "type": "method",
+        "class": "SessionsController",
+        "method": "consent_form"
+      },
+      "user_input": "params[:id]",
+      "confidence": "Weak",
+      "cwe_id": [
+        22
+      ],
+      "note": "Programme names/types come from a limited set of enums."
+    }
+  ],
+  "updated": "2024-10-28 08:48:24 +0000",
+  "brakeman_version": "6.2.1"
+}

config/routes.rb

@@ -149,6 +149,8 @@
       get "close", action: "edit_close"
       post "close", action: "update_close"
 
+      get "consent-form"
+
       constraints -> { Flipper.enabled?(:dev_tools) } do
         put "make-in-progress", to: "sessions#make_in_progress"
       end

spec/features/paper_consent_download_spec.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+describe "Paper consent" do
+  scenario "Download the consent form" do
+    given_i_am_signed_in
+
+    when_i_click_download_consent_form
+    then_i_download_a_pdf_consent_form
+  end
+
+  def given_i_am_signed_in
+    programme = create(:programme, :hpv)
+    team = create(:team, :with_one_nurse, programmes: [programme])
+    @session = create(:session, team:, programme:)
+
+    sign_in team.users.first
+  end
+
+  def when_i_click_download_consent_form
+    visit session_path(@session)
+    click_on "Download consent form (PDF)"
+  end
+
+  def then_i_download_a_pdf_consent_form
+    expect(page.status_code).to eq(200)
+
+    # PDF files include this string at the start
+    expect(page).to have_content("PDF")
+  end
+end