Authorize showing project

Author: zetter-rpf

app/controllers/api/scratch/projects_controller.rb

@@ -9,6 +9,7 @@ class ProjectsController < ScratchController
       before_action :ensure_create_is_a_remix, only: %i[create]
 
       def show
+        authorize! :show, @project
         render json: @project.scratch_component.content_with_stage_first
       end
 

spec/features/scratch/showing_a_scratch_project_spec.rb

@@ -6,13 +6,18 @@
   let(:school) { create(:school) }
   let(:teacher) { create(:teacher, school:) }
   let(:headers) { { 'Authorization' => UserProfileMock::TOKEN } }
+  let(:school_class) { create(:school_class, school:, teacher_ids: [teacher.id]) }
+  let(:lesson) { create(:lesson, school:, school_class:, user_id: teacher.id) }
 
   it 'returns scratch project JSON' do
     authenticated_in_hydra_as(teacher)
     project = create(
       :project,
       project_type: Project::Types::CODE_EDITOR_SCRATCH,
-      locale: 'en'
+      locale: 'en',
+      school: school,
+      user_id: teacher.id,
+      lesson: lesson
     )
     create(:scratch_component, project: project)
 
@@ -29,7 +34,10 @@
     project = create(
       :project,
       project_type: Project::Types::CODE_EDITOR_SCRATCH,
-      locale: 'en'
+      locale: 'en',
+      school: school,
+      lesson: lesson,
+      user_id: teacher.id
     )
     create(
       :scratch_component,
@@ -71,4 +79,18 @@
 
     expect(response).to have_http_status(:unauthorized)
   end
+
+  it 'returns a 403 forbidden if user does not have access to the project' do
+    authenticated_in_hydra_as(teacher)
+    project = create(
+      :project,
+      project_type: Project::Types::CODE_EDITOR_SCRATCH,
+      locale: 'en'
+    )
+    create(:scratch_component, project: project)
+
+    get "/api/scratch/projects/#{project.identifier}", headers: headers
+
+    expect(response).to have_http_status(:forbidden)
+  end
 end