868 add school email domain api

[PetarSimonovic]

Status

• Closes Add school email domain API #868

Description

A REST API that allows school owners and teachers to create and list SchoolEmailDomains.

• Owners and teachers can list/create; students and users from other schools cannot
• Domains are validated (FQDN format, URI, registrable public suffix) with translated error messages
• New domains are synced to Profile; the DB transaction rolls back if Profile sync fails
• Delete is out of scope for this PR

What's changed?

• GET /api/schools/:school_id/school_email_domains — list domains
• POST /api/schools/:school_id/school_email_domains — create a domain
• Added concept with Profile sync + rollback on failure
• Validation with translated error messages
• Specs at validator, model, concept, and feature levels

[github-actions]

Test coverage

91.94% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/27937894440

[Copilot]

Pull request overview

Adds a REST API for managing a school’s allowed student email domains, intended for use by authorised school owners/teachers and kept in sync with the Profile service.

Changes:

• Introduces GET /api/schools/:school_id/school_email_domains (list) and POST /api/schools/:school_id/school_email_domains (create) endpoints.
• Adds a SchoolEmailDomain::Create concept that persists the domain and syncs the school’s full domain list to Profile (rolling back on sync failure).
• Extends authorisation and i18n error messages, plus adds factories and request/unit specs.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
spec/support/profile_api_mock.rb	Adds a stub helper for Profile “update school email domains” calls in specs.
spec/features/school_email_domain/listing_school_email_domains_spec.rb	Request specs for listing domains with auth/unauth coverage.
spec/features/school_email_domain/creating_school_email_domains_spec.rb	Request specs for creating domains, validation errors, and Profile failure handling.
spec/factories/school_email_domain.rb	Factory for SchoolEmailDomain.
spec/concepts/school_email_domain/create_spec.rb	Unit coverage for the SchoolEmailDomain::Create concept.
lib/concepts/school_email_domain/operations/create.rb	Implements the create + Profile sync operation with rollback on failure.
config/routes.rb	Wires nested school email domain routes under schools.
config/locales/en.yml	Adds translated validation messages for domain validation error codes.
app/models/ability.rb	Grants school owners/teachers ability to read/create school email domains.
app/controllers/api/school_email_domains_controller.rb	Adds the API controller for index/create with CanCan authorisation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e24d6af. Configure here.}

[cursor]

Concurrent creates desync Profile

Medium Severity

Under concurrent domain creation, update_profile reads the list of domains within its transaction. This isolation means a later request can overwrite the external Profile service with an incomplete list, effectively dropping domains that were successfully committed by an earlier, concurrent transaction.

 

^{Reviewed by Cursor Bugbot for commit e24d6af. Configure here.}