update tests

Author: rammodhvadia

spec/factories/project.rb

@@ -67,5 +67,10 @@
       instructions { Faker::Lorem.paragraph }
       school factory: %i[school]
     end
+
+    factory :scratch_project do
+      project_type { Project::Types::CODE_EDITOR_SCRATCH }
+      scratch_component
+    end
   end
 end

spec/features/scratch/creating_a_scratch_project_spec.rb

@@ -54,13 +54,35 @@ def make_request(query: request_query, request_headers: headers, request_params:
     expect(response).to have_http_status(:unauthorized)
   end
 
-  it 'responds 404 Not Found when user is not part of a school' do
-    user = create(:user)
-    authenticated_in_hydra_as(user)
+  context 'when authenticated but not part of a school' do
+    let(:user) { create(:user) }
 
-    make_request
+    before do
+      authenticated_in_hydra_as(user)
+    end
+
+    it 'responds 403 forbidden when the user cannot access the original project' do
+      make_request
 
-    expect(response).to have_http_status(:not_found)
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    context 'when the original project is anonymous scratch project' do
+      let(:original_project) do
+        create(
+          :project,
+          user_id: nil,
+          project_type: Project::Types::CODE_EDITOR_SCRATCH,
+          locale: 'en'
+        )
+      end
+
+      it 'responds 200 ok' do
+        make_request
+
+        expect(response).to have_http_status(:ok)
+      end
+    end
   end
 
   context 'when authenticated and part of a school' do

spec/features/scratch/creating_and_showing_a_scratch_asset_spec.rb

@@ -20,7 +20,29 @@
       expect(response).to have_http_status(:bad_request)
     end
 
-    context 'when the user can view the project' do
+    context 'when the user is not logged in' do
+      let(:project_headers) { { 'X-Project-ID' => project.identifier } }
+
+      it 'responds with unathorized' do
+        create_uploaded_scratch_asset(filename: 'test_image_1.png', project:, body: 'global-body')
+        get '/api/scratch/assets/internalapi/asset/test_image_1.png/get/', headers: project_headers
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+
+      context 'when the project is anonymous' do
+        let(:project) { create_scratch_project(locale: 'en', user_id: nil) }
+
+        it 'responds with 200 ok' do
+          create_uploaded_scratch_asset(filename: 'test_image_1.png', project: nil, body: 'global-body')
+          get '/api/scratch/assets/internalapi/asset/test_image_1.png/get/', headers: project_headers
+
+          expect(response).to have_http_status(:found)
+        end
+      end
+    end
+
+    context 'when the project owner is logged in' do
       before do
         authenticated_in_hydra_as(teacher)
       end
@@ -385,15 +407,6 @@
 
       expect(response).to have_http_status(:unauthorized)
     end
-
-    it 'responds 404 Not Found when user is not part of a school' do
-      user = create(:user)
-      authenticated_in_hydra_as(user)
-
-      post '/api/scratch/assets/example.svg', headers: project_headers
-
-      expect(response).to have_http_status(:not_found)
-    end
   end
 
   def create_scratch_project(**attributes)

spec/features/scratch/showing_a_scratch_project_spec.rb

@@ -5,6 +5,7 @@
 RSpec.describe 'Showing a Scratch project', type: :request do
   let(:school) { create(:school) }
   let(:teacher) { create(:teacher, school:) }
+  let(:student) { create(:student, school:) }
   let(:headers) { { 'Authorization' => UserProfileMock::TOKEN } }
   let(:school_class) { create(:school_class, school:, teacher_ids: [teacher.id]) }
   let(:lesson) { create(:lesson, school:, school_class:, user_id: teacher.id) }
@@ -73,11 +74,19 @@
     expect(response).to have_http_status(:not_found)
   end
 
-  it 'returns a 401 unauthorized if not logged in' do
-    project = create(:project, project_type: Project::Types::PYTHON, locale: 'en')
+  it 'returns a 200 ok if not logged in for an anonymous scratch project' do
+    project = create(:scratch_project, locale: 'en', user_id: nil)
     get "/api/scratch/projects/#{project.identifier}"
 
-    expect(response).to have_http_status(:unauthorized)
+    expect(response).to have_http_status(:ok)
+  end
+
+  it 'returns a 200 ok if logged in for an anonymous scratch project' do
+    authenticated_in_hydra_as(student)
+    project = create(:scratch_project, locale: 'en', user_id: nil)
+    get "/api/scratch/projects/#{project.identifier}"
+
+    expect(response).to have_http_status(:ok)
   end
 
   it 'returns a 403 forbidden if user does not have access to the project' do