List FOI Attachments on admin page

When handling data breaches we need to find the hexdigest of the
attachment to ensure it gets purged from all caches / backups etc.

Its quite hard to do this – even from the console – and any console
commands are prone to error. Its easier to just show the associated
attachments on the admin interface, along with some less user-friendly
information that's useful for admin purposes.

app/views/admin_incoming_message/_foi_attachments.html.erb

@@ -0,0 +1,30 @@
+<fieldset id="attachments" class="form-horizontal">
+  <legend>Attachments</legend>
+
+  <% if foi_attachments.any? %>
+    <table class="table">
+      <thead>
+        <tr>
+          <th>ID</th>
+          <th>Filename</th>
+          <th>Content Type</th>
+          <th>Hexdigest</th>
+          <th>Display Size</th>
+        </tr>
+      </thead>
+      <tbody>
+        <% foi_attachments.each do |attachment| %>
+          <tr>
+            <td><tt><%= attachment.id %></tt></td>
+            <td><tt><%= attachment.filename %></tt></td>
+            <td><tt><%= attachment.content_type %></tt></td>
+            <td><tt><%= attachment.hexdigest %></tt></td>
+            <td><tt><%= attachment.display_size %></tt></td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  <% else %>
+    <p>No attachments.</p>
+  <% end %>
+</fieldset>

app/views/admin_incoming_message/edit.html.erb

@@ -26,3 +26,6 @@
     </div>
   <% end %>
 </fieldset>
+
+<%= render partial: 'foi_attachments',
+           locals: { foi_attachments: @incoming_message.foi_attachments } %>

doc/CHANGES.md

@@ -2,6 +2,8 @@
 
 ## Highlighted Features
 
+* Show incoming message attachments in admin interface (Gareth Rees)
+
 ## Upgrade Notes
 
 ### Changed Templates