Return a 404 when a `dmd-download.csv` request is made for a non-BNF codelist

[KatieB5]

Why are we doing this?

We had a Sentry alert on Weds 29th July as a result of a number of requests to:

/codelist/{organisation_slug}/{codelist_slug}/{tag_or_hash}/dmd-download.csv

The dmd-download.csv view assumes it is being called for a BNF-based codelist. However, these requests were made for non-BNF codelists. For example:

• request: http://www.opencodelists.org/codelist/bristol/opioid-agonist-therapy-oat-snomed-ct/00f6d74e/dmd-download.csv
• corresponding codelist: http://www.opencodelists.org/codelist/bristol/opioid-agonist-therapy-oat-snomed-ct/00f6d74e/ (a SNOMED CT (UK Clinical Edition) codelist)

When the view attempts to generate the download, it calls dmd_csv_data_for_download(), which asserts that the codelist is BNF-based. This raises an AssertionError, causing the request to return a 500.

From the investigation, it appears these requests were made directly to the endpoint (likely automated probing), rather than via the OpenCodelists UI. A full write-up of the investigation is available in the Slack thread here.

The endpoint currently returns a 500 for a request that cannot succeed. We should decide whether to:

• return a more appropriate response (for example, 404 not found), or
• leave the current behaviour unchanged.

We have had another Sentry alert today (Mon 3rd Aug) due to the above issue.

How will we know when it's done?

• We've decided whether to change the behaviour of this endpoint.
• If we're making a change, it has been implemented and deployed.
• If we're not making a change, we've documented the decision in this issue.
• The related Sentry issue has been archived or resolved, as appropriate.

What are we doing?

• Decide whether we want to change the behaviour of this endpoint.
• If so, implement the agreed change; otherwise, document the decision to leave the current behaviour unchanged.
• Archive or resolve the Sentry issue, depending on the outcome.

---

Defining delivery tasks guidance

[KatieB5]

We discussed the issue as a team in planning:

• Immediate action: We've clicked "Archived until it escalates" in Sentry
• Future action: return and address the issue as a deck-scrubbing activity (we agreed that we'd like to do something about it but agreed it's not super urgent)