Prevent downloading a bulk upload as a non-support user

app/controllers/lettings_logs_controller.rb

@@ -135,6 +135,8 @@ class LettingsLogsController < LogsController
   end
 
   def download_bulk_upload
+    return render_not_authorized unless current_user.support?
+
     bulk_upload = BulkUpload.find(params[:id])
     downloader = BulkUpload::Downloader.new(bulk_upload:)
 

app/controllers/sales_logs_controller.rb

@@ -105,6 +105,8 @@ class SalesLogsController < LogsController
   end
 
   def download_bulk_upload
+    return render_not_authorized unless current_user.support?
+
     bulk_upload = BulkUpload.find(params[:id])
     downloader = BulkUpload::Downloader.new(bulk_upload:)