validate Batch Inventory Worksheet uploaded to ballot manifest

server/api/ballot_manifest.py

@@ -4,6 +4,7 @@
 from datetime import datetime
 from flask import request, jsonify, Request, session
 from werkzeug.exceptions import BadRequest, NotFound
+from werkzeug.datastructures import FileStorage
 from sqlalchemy import func
 from sqlalchemy.orm import Session
 
@@ -56,6 +57,8 @@ class CountingGroup(str, enum.Enum):
 NUMBER_OF_BALLOTS = "Number of Ballots"
 CVR = "CVR"
 
+BATCH_INVENTORY_WORKSHEET_UPLOADED_ERROR = 'You have uploaded a Batch Inventory Worksheet. Please upload a ballot manifest file exported from Step 4: "Download Audit Files".'
+
 
 def all_manifests_uploaded(contest: Contest):
     return all(
@@ -228,12 +231,25 @@ def process() -> None:
         session.commit()
 
 
+def is_batch_inventory_worksheet(first_line: bytes) -> bool:
+    return first_line.decode("utf-8").strip() == "Batch Inventory Worksheet"
+
+
+def validate_is_not_batch_inventory_worksheet(file: FileStorage):
+    first_line = file.stream.readline()
+    file.stream.seek(0)
+    if is_batch_inventory_worksheet(first_line):
+        raise BadRequest(BATCH_INVENTORY_WORKSHEET_UPLOADED_ERROR)
+
+
 # Raises if invalid
 def validate_ballot_manifest_upload(request: Request):
     if "manifest" not in request.files:
         raise BadRequest("Missing required file parameter 'manifest'")
 
-    validate_csv_mimetype(request.files["manifest"])
+    file = request.files["manifest"]
+    validate_is_not_batch_inventory_worksheet(file)
+    validate_csv_mimetype(file)
 
 
 def save_ballot_manifest_file(manifest, jurisdiction: Jurisdiction):

server/tests/api/test_ballot_manifest.py

@@ -171,6 +171,32 @@ def test_ballot_manifest_upload_missing_file(
     }
 
 
+def test_ballot_manifest_upload_batch_inventory_worksheet(
+    client: FlaskClient, election_id: str, jurisdiction_ids: List[str]
+):
+    set_logged_in_user(
+        client, UserType.JURISDICTION_ADMIN, default_ja_email(election_id)
+    )
+    rv = client.put(
+        f"/api/election/{election_id}/jurisdiction/{jurisdiction_ids[0]}/ballot-manifest",
+        data={
+            "manifest": (
+                io.BytesIO(b"Batch Inventory Worksheet \r\n"),
+                "batch-inventory-worksheet.csv",
+            )
+        },
+    )
+    assert rv.status_code == 400
+    assert json.loads(rv.data) == {
+        "errors": [
+            {
+                "errorType": "Bad Request",
+                "message": 'You have uploaded a Batch Inventory Worksheet. Please upload a ballot manifest file exported from Step 4: "Download Audit Files".',
+            }
+        ]
+    }
+
+
 def test_ballot_manifest_upload_bad_csv(
     client: FlaskClient, election_id: str, jurisdiction_ids: List[str]
 ):