Repository: pypi/warehouse

Issue:
[UX+bug] UI for non-activated organizations in clickable where it shouldn't be: disabled `[Activate Billing]` can lead to HTTP 500
**Describe the bug**
<!-- A clear and concise description the bug -->
This is similar to https://github.com/pypi/warehouse/issues/10773. A disabled button is clickable for a non-reviewed/non-approved org and it allows navigating to a "forbidden" page that possibly tracebacks internally.

**Expected behavior**
<!-- A clear and concise description of what you expected to happen -->
1. The button shouldn't be clickable.
2. The activation page shouldn't render HTTP 500 but rather HTTP 401/403.

**To Reproduce**
<!-- Steps to reproduce the bug, or a link to PyPI where the bug is visible -->
1. Create an organization at https://pypi.org/manage/organizations/
2. Click on a "disabled" `[Activate Billing]` button.
3. Get surprised it's clickable.
4. Click on the `[Activate Subscription]` button.
5. See an HTTP 500 page implying that PyPI is down.

**My Platform**
Chrome on Android, probably unrelated.

**Additional context**
<!-- Add any other context, links, etc. about the feature here. -->
![Screenshot_2023-04-23-14-03-34-54_40deb401b9ffe8e1df2f1cc5ba480b12](https://user-images.githubusercontent.com/578543/233863544-135ada22-ab7e-4a5a-85bf-a22cdab6201a.jpg)
![Screenshot_2023-04-23-14-04-44-17_40deb401b9ffe8e1df2f1cc5ba480b12](https://user-images.githubusercontent.com/578543/233863546-61f1e993-e303-40b7-85b5-31ceb88c1e1b.jpg)



Discussion:
Thanks! We changed the visibility to disable, but didn't actually disable the button.
Yeah, but I suppose there's two bugs, the second one being the ability to navigate to the nested URLs behind that button.
Agreed - but I think disabling the button AND href will be enough for now until we re-instate billing.

Resolving patch:
diff --git a/warehouse/manage/views/organizations.py b/warehouse/manage/views/organizations.py
--- a/warehouse/manage/views/organizations.py
+++ b/warehouse/manage/views/organizations.py
@@ -558,7 +558,9 @@ def manage_subscription(self):
         renderer="manage/organization/activate_subscription.html",
     )
     def activate_subscription(self):
-        return {"organization": self.organization}
+        # We're not ready for companies to activate their own subscriptions yet.
+        raise HTTPNotFound()
+        # return {"organization": self.organization}
 
     @view_config(route_name="manage.organization.subscription")
     def create_or_manage_subscription(self):


Test patch:
diff --git a/tests/unit/manage/views/test_organizations.py b/tests/unit/manage/views/test_organizations.py
--- a/tests/unit/manage/views/test_organizations.py
+++ b/tests/unit/manage/views/test_organizations.py
@@ -1097,9 +1097,14 @@ def test_activate_subscription(
         enable_organizations,
     ):
         view = org_views.ManageOrganizationBillingViews(organization, db_request)
-        result = view.activate_subscription()
 
-        assert result == {"organization": organization}
+        # We're not ready for companies to activate their own subscriptions yet.
+        with pytest.raises(HTTPNotFound):
+            assert view.activate_subscription()
+
+        # result = view.activate_subscription()
+
+        # assert result == {"organization": organization}
 
     def test_create_subscription(
         self,