Fix authorization in Api::ProjectsController

app/controllers/api/projects_controller.rb

@@ -7,7 +7,8 @@ class ProjectsController < ApiController
     before_action :authorize_user, only: %i[create update index destroy]
     before_action :load_project, only: %i[show update destroy show_context]
     before_action :load_projects, only: %i[index]
-    load_and_authorize_resource
+    load_resource only: :create
+    authorize_resource
     before_action :verify_lesson_belongs_to_school, only: :create
     after_action :pagination_link_header, only: %i[index]
 
@@ -73,6 +74,7 @@ def load_project
                  else
                    project_loader.load
                  end
+      raise ActiveRecord::RecordNotFound if @project.blank?
     end
 
     def load_projects

spec/features/project/updating_a_project_spec.rb

@@ -3,14 +3,9 @@
 require 'rails_helper'
 
 RSpec.describe 'Updating a project', type: :request do
-  before do
-    authenticated_in_hydra_as(owner)
-
-    create(:component, project:, name: 'main', extension: 'py', content: 'print("hi")')
-  end
-
   let(:headers) { { Authorization: UserProfileMock::TOKEN } }
-  let!(:project) { create(:project, name: 'Test Project', user_id: owner.id) }
+  let(:locale) { 'en' }
+  let!(:project) { create(:project, name: 'Test Project', user_id: owner.id, locale:) }
   let(:owner) { create(:owner, school:) }
   let(:school) { create(:school) }
 
@@ -25,32 +20,61 @@
     }
   end
 
+  before do
+    authenticated_in_hydra_as(owner)
+
+    create(:component, project:, name: 'main', extension: 'py', content: 'print("hi")')
+  end
+
   it 'responds 200 OK' do
-    put("/api/projects/#{project.id}", headers:, params:)
+    put("/api/projects/#{project.identifier}", headers:, params:)
     expect(response).to have_http_status(:ok)
   end
 
   it 'responds with the project JSON' do
-    put("/api/projects/#{project.id}", headers:, params:)
+    put("/api/projects/#{project.identifier}", headers:, params:)
     data = JSON.parse(response.body, symbolize_names: true)
 
     expect(data[:name]).to eq('New Name')
   end
 
   it 'responds with the components JSON' do
-    put("/api/projects/#{project.id}", headers:, params:)
+    put("/api/projects/#{project.identifier}", headers:, params:)
     data = JSON.parse(response.body, symbolize_names: true)
 
     expect(data[:components].first[:content]).to eq('print("hello")')
   end
 
   it 'responds 422 Unprocessable Entity when params are invalid' do
-    put("/api/projects/#{project.id}", headers:, params: { project: { components: [{ name: ' ' }] } })
+    put("/api/projects/#{project.identifier}", headers:, params: { project: { components: [{ name: ' ' }] } })
     expect(response).to have_http_status(:unprocessable_entity)
   end
 
   it 'responds 401 Unauthorized when no token is given' do
-    put("/api/projects/#{project.id}", params:)
+    put("/api/projects/#{project.identifier}", params:)
     expect(response).to have_http_status(:unauthorized)
   end
+
+  context 'when locale is nil, i.e. the other fallback locale in ProjectLoader' do
+    let(:locale) { nil }
+
+    it 'responds 200 OK even though no locale is specified in query string' do
+      put("/api/projects/#{project.identifier}", headers:, params:)
+      expect(response).to have_http_status(:ok)
+    end
+  end
+
+  context "when locale is 'fr', i.e. not a fallback locale in ProjectLoader" do
+    let(:locale) { 'fr' }
+
+    it 'responds 200 OK if locale is specified in query string' do
+      put("/api/projects/#{project.identifier}?locale=fr", headers:, params:)
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'responds 404 Not Found if locale is not specified in query string' do
+      put("/api/projects/#{project.identifier}", headers:, params:)
+      expect(response).to have_http_status(:not_found)
+    end
+  end
 end