Add auth

app/controllers/duplicate_logs_controller.rb

@@ -1,10 +1,15 @@
 class DuplicateLogsController < ApplicationController
+  before_action :authenticate_user!
   before_action :find_resource_by_named_id
 
   def show
+    if @log
       @duplicate_logs = @log.class.duplicate_logs_for_organisation(current_user.organisation_id, @log)
       @all_duplicates = [@log, *@duplicate_logs]
       @duplicate_check_questions = duplicate_check_question_ids.map { |question_id| @log.form.get_question(question_id, @log) }.compact
+    else
+      render_not_found
+    end
   end
 
 private

spec/requests/duplicate_logs_controller_spec.rb

@@ -20,12 +20,34 @@ RSpec.describe DuplicateLogsController, type: :request do
       )
     end
 
+    describe "GET" do
+      context "when user is not signed in" do
+        it "redirects to sign in page" do
+          get "/lettings-logs/#{lettings_log.id}/duplicate-logs"
+          expect(response).to redirect_to("/account/sign-in")
+        end
+      end
+
+      context "when the user is from different organisation" do
+        let(:other_user) { create(:user) }
+
+        before do
+          allow(other_user).to receive(:need_two_factor_authentication?).and_return(false)
+          sign_in other_user
+        end
+
+        it "renders page not found" do
+          get "/lettings-logs/#{lettings_log.id}/duplicate-logs"
+          expect(response).to have_http_status(:not_found)
+        end
+      end
+
+      context "when user is signed in" do
         before do
           allow(user).to receive(:need_two_factor_authentication?).and_return(false)
           sign_in user
         end
 
-    describe "GET" do
         context "with multiple duplicate lettings logs" do
           let(:duplicate_logs) { create_list(:lettings_log, 2, :completed) }
 
@@ -89,3 +111,4 @@ RSpec.describe DuplicateLogsController, type: :request do
       end
     end
   end
+end