diff --git a/app/controllers/api/scratch/projects_controller.rb b/app/controllers/api/scratch/projects_controller.rb index 4904724d3..dcae49e89 100644 --- a/app/controllers/api/scratch/projects_controller.rb +++ b/app/controllers/api/scratch/projects_controller.rb @@ -6,13 +6,27 @@ class ProjectsController < ScratchController skip_before_action :authorize_user, only: [:show] skip_before_action :check_scratch_feature, only: [:show] + before_action :ensure_create_is_a_remix, only: %i[create] + def show render :show, formats: [:json] end + def create + render json: { status: 'ok', 'content-name': 'new-project-id' }, status: :ok + end + def update render json: { status: 'ok' }, status: :ok end + + private + + def ensure_create_is_a_remix + return if params[:is_remix] == '1' + + render json: { error: 'Only remixing existing projects is allowed' }, status: :forbidden + end end end end diff --git a/config/routes.rb b/config/routes.rb index 6dfc482c3..9aefae218 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -34,7 +34,7 @@ namespace :api do namespace :scratch do - resources :projects, only: %i[show update] + resources :projects, only: %i[show update create] get '/assets/internalapi/asset/:id(.:format)/get/' => 'assets#show' post '/assets/:id' => 'assets#create' end diff --git a/spec/features/scratch/creating_a_scratch_project_spec.rb b/spec/features/scratch/creating_a_scratch_project_spec.rb new file mode 100644 index 000000000..a06446997 --- /dev/null +++ b/spec/features/scratch/creating_a_scratch_project_spec.rb @@ -0,0 +1,51 @@ +# frozen_string_literal: true + +require 'rails_helper' + +RSpec.describe 'Creating a Scratch project (remixing)', type: :request do + let(:school) { create(:school) } + let(:teacher) { create(:teacher, school:) } + let(:cookie_headers) { { 'Cookie' => "scratch_auth=#{UserProfileMock::TOKEN}" } } + let(:params) { { original_id: 'original-project-id', project: { targets: [] }, is_remix: '1' } } + + before do + Flipper.disable :cat_mode + Flipper.disable_actor :cat_mode, school + end + + it 'responds 401 Unauthorized when no cookie is provided' do + post '/api/scratch/projects', params: params + + expect(response).to have_http_status(:unauthorized) + end + + it 'responds 404 Not Found when cat_mode is not enabled' do + authenticated_in_hydra_as(teacher) + + post '/api/scratch/projects', params: params, headers: cookie_headers + + expect(response).to have_http_status(:not_found) + end + + it 'responds 403 Forbidden when not remixing' do + authenticated_in_hydra_as(teacher) + Flipper.enable_actor :cat_mode, school + + post '/api/scratch/projects', params: params.merge(is_remix: '0'), headers: cookie_headers + + expect(response).to have_http_status(:forbidden) + end + + it 'return new project id when cat_mode is enabled and a cookie is provided' do + authenticated_in_hydra_as(teacher) + Flipper.enable_actor :cat_mode, school + + post '/api/scratch/projects', params: params, headers: cookie_headers + + expect(response).to have_http_status(:ok) + + data = JSON.parse(response.body, symbolize_names: true) + expect(data[:status]).to eq('ok') + expect(data[:'content-name']).to eq('new-project-id') + end +end