FIX: Confirm `draft_key` is present on GET

Also adds a test for the `show` action which did not exist

app/controllers/draft_controller.rb

@@ -6,6 +6,8 @@ class DraftController < ApplicationController
   skip_before_action :check_xhr, :preload_json
 
   def show
+    raise Discourse::NotFound.new if params[:draft_key].blank?
+
     seq = params[:sequence] || DraftSequence.current(current_user, params[:draft_key])
     render json: { draft: Draft.get(current_user, params[:draft_key], seq), draft_sequence: seq }
   end

spec/requests/draft_controller_spec.rb

@@ -27,6 +27,19 @@ describe DraftController do
     expect(response.status).to eq(404)
   end
 
+  it "returns a draft if requested" do
+    user = sign_in(Fabricate(:user))
+    Draft.set(user, 'hello', 0, 'test')
+
+    get "/draft.json", params: { draft_key: 'hello' }
+    expect(response.status).to eq(200)
+    json = ::JSON.parse(response.body)
+    expect(json['draft']).to eq('test')
+
+    get "/draft.json"
+    expect(response.status).to eq(404)
+  end
+
   it 'checks for an conflict on update' do
     user = sign_in(Fabricate(:user))
     post = Fabricate(:post, user: user)