chore: add school id post review

Author: DNR500

app/models/ability.rb

@@ -98,9 +98,9 @@ def define_school_teacher_abilities(user:, school:)
         school_class_id: ClassTeacher.where(teacher_id: user.id).select(:school_class_id)
       )
     ).pluck(:id)
-    can(%i[read show_context], Project, remixed_from_id: teacher_project_ids)
-    can(%i[show_status unsubmit return complete], SchoolProject, project: { remixed_from_id: teacher_project_ids })
-    can(%i[read create destroy], Feedback, school_project: { project: { remixed_from_id: teacher_project_ids } })
+    can(%i[read show_context], Project, school_id: school.id, remixed_from_id: teacher_project_ids)
+    can(%i[show_status unsubmit return complete], SchoolProject, project: { school_id: school.id, remixed_from_id: teacher_project_ids })
+    can(%i[read create destroy], Feedback, school_project: { project: { school_id: school.id, remixed_from_id: teacher_project_ids } })
     can(%i[exchange_code], :google_auth)
   end
 

spec/models/ability_spec.rb

@@ -372,6 +372,19 @@
         it { is_expected.to be_able_to(:complete, remixed_project.school_project) }
       end
 
+      context 'when remix school_id does not match the parent lesson project school' do
+        let(:other_school) { create(:school) }
+        let(:other_student) { create(:student, school: other_school) }
+        let!(:cross_school_remix) do
+          create(:project, school: other_school, user_id: other_student.id, remixed_from_id: original_project.id)
+        end
+        let(:user) { teacher }
+
+        it { is_expected.not_to be_able_to(:read, cross_school_remix) }
+        it { is_expected.not_to be_able_to(:show_context, cross_school_remix) }
+        it { is_expected.not_to be_able_to(:return, cross_school_remix.school_project) }
+      end
+
       context 'when user is another teacher of the class' do
         let(:user) { another_teacher }