Add authorization for updating scratch projects

Author: zetter-rpf

app/controllers/api/scratch/projects_controller.rb

@@ -48,6 +48,7 @@ def create
       end
 
       def update
+        authorize! :update, @project
         @project.scratch_component&.content = scratch_content_params
         @project.save!
         render json: { status: 'ok' }, status: :ok

spec/features/scratch/updating_a_scratch_project_spec.rb

@@ -6,6 +6,8 @@
   let(:school) { create(:school) }
   let(:teacher) { create(:teacher, school:) }
   let(:auth_headers) { { 'Authorization' => UserProfileMock::TOKEN } }
+  let(:school_class) { create(:school_class, school:, teacher_ids: [teacher.id]) }
+  let(:lesson) { create(:lesson, school:, school_class:, user_id: teacher.id) }
 
   it 'responds 401 Unauthorized when no Authorization header is provided' do
     put '/api/scratch/projects/any-identifier', params: { project: { targets: [] } }
@@ -18,7 +20,10 @@
     project = create(
       :project,
       project_type: Project::Types::CODE_EDITOR_SCRATCH,
-      locale: 'en'
+      locale: 'en',
+      school: school,
+      lesson: lesson,
+      user_id: teacher.id
     )
     create(:scratch_component, project: project)
 
@@ -31,4 +36,18 @@
 
     expect(project.reload.scratch_component.content.to_h['targets']).to eq(['some update'])
   end
+
+  it 'returns 403 Forbidden when trying to update a project user does not have access to' do
+    authenticated_in_hydra_as(teacher)
+    project = create(
+      :project,
+      project_type: Project::Types::CODE_EDITOR_SCRATCH,
+      locale: 'en'
+    )
+    create(:scratch_component, project: project)
+
+    put "/api/scratch/projects/#{project.identifier}", params: { targets: ['some update'] }, headers: auth_headers
+
+    expect(response).to have_http_status(:forbidden)
+  end
 end