Allow students to view the preview projects - #974
Conversation
Test coverage93.34% line coverage reported by SimpleCov. |
There was a problem hiding this comment.
Pull request overview
Updates CanCanCan authorization in the Rails monolith to allow school students to access the unowned Experience CS preview starter project (and related data) so the editor-standalone classroom preview route can load the project successfully.
Changes:
- Adds a student-specific
:showpermission for unownedProjects of typeProject::Types::CODE_EDITOR_SCRATCH. - Adds a corresponding student-specific
:showpermission forComponents belonging to those unowned scratch projects.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| can :show, Project, user_id: nil, school_id: nil, project_type: Project::Types::CODE_EDITOR_SCRATCH | ||
| can :show, Component, project: { user_id: nil, school_id: nil, project_type: Project::Types::CODE_EDITOR_SCRATCH } | ||
| return | ||
| end |
There was a problem hiding this comment.
I think the placement of these rules aren't quite right because they are in the non_student_abilities method but apply to students.
If these projects should be visible to everyone (which I think is the case), then they should be here without the if user&.student? check
If these projects should be visible by student (but not the general public) then they should live in a define_school_student_abilities method, or a more general define_school_student_global_abilities method since these abilities aren't specific to a school like the others are.
There was a problem hiding this comment.
I've just seen the rules below which I missed before. Is it important we restrict students from seeing other public projects (which they can presumably see anyway if they sign out?). If not, maybe this could be solved by removing the return if user&.student? return and renaming define_common_non_student_abilities to define_common_abilities
Needs to allow student view checks on issue: 1659
Comes out of this work on editor-standalone - https://github.com/RaspberryPiFoundation/editor-standalone/pull/1064
Summary
Updated
editor-apiCanCan permissions so that school students can:showthe Experience CS preview starter project used by the classroom preview route.With this changes students are now allowed to view unowned (
user_id: nil,school_id: nil) Scratch template projects.This prevents the preview route in editor-standalone from failing project loading (which previously triggered a redirect to
/${locale}/error).