ensure that non support users may not download codes only exports

app/controllers/lettings_logs_controller.rb

@@ -2,10 +2,16 @@ class LettingsLogsController < LogsController
   before_action :find_resource, except: %i[create index edit]
   before_action :session_filters, if: :current_user, only: %i[index email_csv download_csv]
   before_action :set_session_filters, if: :current_user, only: %i[index email_csv download_csv]
+  before_action :authenticate_scope!, only: %i[download_csv email_csv]
 
   before_action :extract_bulk_upload_from_session_filters, only: [:index]
   before_action :redirect_if_bulk_upload_resolved, only: [:index]
 
+  def authenticate_scope!
+    codes_only_export = codes_only_export?(params)
+    head :unauthorized and return unless current_user.support? || !codes_only_export
+  end
+
   def index
     respond_to do |format|
       format.html do