Add remixes endpoint (#410)

## Status

- Closes _add issue numbers or delete_
- Related to _add issue numbers or delete_

## Points for consideration:

- Security
- Performance

## What's changed?

_Description of what's been done - bullets are often best_

## Steps to perform after deploying to production

_If the production environment requires any extra work after this PR has
been deployed detail it here. This could be running a Rake task, a
migration, or upgrading a Gem. That kind of thing._

Author: loiswells97

app/controllers/api/projects/remixes_controller.rb

@@ -4,6 +4,13 @@ module Api
   module Projects
     class RemixesController < ApiController
       before_action :authorize_user
+      load_and_authorize_resource :school, only: :index
+
+      def index
+        projects = Project.where(remixed_from_id: project.id).accessible_by(current_ability)
+        @projects_with_users = projects.with_users(@current_user)
+        render index: @projects_with_users, formats: [:json]
+      end
 
       def show
         @project = Project.find_by!(remixed_from_id: project.id, user_id: current_user&.id)

app/models/project.rb

@@ -21,17 +21,21 @@ class Project < ApplicationRecord
 
   scope :internal_projects, -> { where(user_id: nil) }
 
-  def self.users
-    User.from_userinfo(ids: pluck(:user_id))
+  def self.users(current_user)
+    school = School.find_by(id: pluck(:school_id))
+    SchoolStudent::List.call(school:, token: current_user.token, student_ids: pluck(:user_id))[:school_students] || []
   end
 
-  def self.with_users
-    by_id = users.index_by(&:id)
+  def self.with_users(current_user)
+    by_id = users(current_user).index_by(&:id)
     all.map { |instance| [instance, by_id[instance.user_id]] }
   end
 
-  def with_user
-    [self, User.from_userinfo(ids: user_id).first]
+  def with_user(current_user)
+    school = School.find_by(id: :school_id)
+    students = SchoolStudent::List.call(school:, token: current_user.token,
+                                        student_ids: [:user_id])[:school_students] || []
+    [self, students.first]
   end
 
   # Work around a CanCanCan issue with accepts_nested_attributes_for.
@@ -40,6 +44,11 @@ def components=(array)
     super(array.map { |o| o.is_a?(Hash) ? Component.new(o) : o })
   end
 
+  def last_edited_at
+    # datetime that the project or one of its components was last updated
+    [updated_at, components.maximum(:updated_at)].compact.max
+  end
+
   private
 
   def check_unique_not_null

app/views/api/projects/remixes/index.json.jbuilder

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+json.array!(@projects_with_users) do |project, user|
+  json.call(
+    project,
+    :identifier,
+    :project_type,
+    :name,
+    :user_id,
+    :updated_at,
+    :last_edited_at
+  )
+
+  json.user_name(user&.name)
+end

config/routes.rb

@@ -34,6 +34,7 @@
 
     resources :projects, only: %i[index show update destroy create] do
       resource :remix, only: %i[show create], controller: 'projects/remixes'
+      resources :remixes, only: %i[index], controller: 'projects/remixes'
       resource :images, only: %i[show create], controller: 'projects/images'
     end
 

spec/models/project_spec.rb

@@ -127,84 +127,117 @@
   end
 
   describe '.users' do
-    it 'returns User instances for the current scope' do
-      student = create(:student, school:, name: 'School Student')
-      stub_user_info_api_for(student)
-      create(:project, user_id: student.id)
+    let(:student) { create(:student, school:, name: 'School Student') }
+    let(:teacher) { create(:teacher, school:) }
+
+    let(:student_attributes) do
+      [{ id: student.id, name: student.name, username: student.username }]
+    end
 
-      user = described_class.all.users.first
+    before do
+      stub_profile_api_list_school_students(school:, student_attributes:)
+    end
+
+    it 'returns User instances for the current scope' do
+      create(:project, user_id: student.id, school_id: school.id)
+      user = described_class.all.users(teacher).first
       expect(user.name).to eq('School Student')
     end
 
     it 'ignores members where no profile account exists' do
       user_id = SecureRandom.uuid
-      stub_user_info_api_for_unknown_users(user_id:)
       create(:project, user_id:)
 
-      user = described_class.all.users.first
+      user = described_class.all.users(teacher).first
       expect(user).to be_nil
     end
 
     it 'ignores members not included in the current scope' do
       create(:project)
 
-      user = described_class.none.users.first
+      user = described_class.none.users(teacher).first
       expect(user).to be_nil
     end
   end
 
   describe '.with_users' do
-    # rubocop:disable RSpec/ExampleLength
+    let(:student) { create(:student, school:) }
+    let(:teacher) { create(:teacher, school:) }
+
+    let(:student_attributes) do
+      [{ id: student.id, name: student.name, username: student.username }]
+    end
+
+    before do
+      stub_profile_api_list_school_students(school:, student_attributes:)
+    end
+
     it 'returns an array of class members paired with their User instance' do
-      student = create(:student, school:)
-      stub_user_info_api_for(student)
       project = create(:project, user_id: student.id)
 
-      pair = described_class.all.with_users.first
-      user = described_class.all.users.first
+      pair = described_class.all.with_users(teacher).first
+      user = described_class.all.users(teacher).first
 
       expect(pair).to eq([project, user])
     end
-    # rubocop:enable RSpec/ExampleLength
 
     it 'returns nil values for members where no profile account exists' do
       user_id = SecureRandom.uuid
-      stub_user_info_api_for_unknown_users(user_id:)
       project = create(:project, user_id:)
 
-      pair = described_class.all.with_users.first
+      pair = described_class.all.with_users(teacher).first
       expect(pair).to eq([project, nil])
     end
 
     it 'ignores members not included in the current scope' do
       create(:project)
 
-      pair = described_class.none.with_users.first
+      pair = described_class.none.with_users(teacher).first
       expect(pair).to be_nil
     end
   end
 
   describe '#with_user' do
-    # rubocop:disable RSpec/ExampleLength
+    let(:student) { create(:student, school:) }
+    let(:teacher) { create(:teacher, school:) }
+
+    let(:student_attributes) do
+      [{ id: student.id, name: student.name, username: student.username }]
+    end
+
+    before do
+      stub_profile_api_list_school_students(school:, student_attributes:)
+    end
+
     it 'returns the class member paired with their User instance' do
-      student = create(:student, school:)
-      stub_user_info_api_for(student)
       project = create(:project, user_id: student.id)
 
-      pair = project.with_user
-      user = described_class.all.users.first
+      pair = project.with_user(teacher)
+      user = described_class.all.users(teacher).first
 
       expect(pair).to eq([project, user])
     end
-    # rubocop:enable RSpec/ExampleLength
 
     it 'returns a nil value if the member has no profile account' do
       user_id = SecureRandom.uuid
-      stub_user_info_api_for_unknown_users(user_id:)
       project = create(:project, user_id:)
 
-      pair = project.with_user
+      pair = project.with_user(teacher)
       expect(pair).to eq([project, nil])
     end
   end
+
+  describe '#last_edited_at' do
+    let(:project) { create(:project, updated_at: 1.day.ago) }
+    let(:component) { create(:component, project:, updated_at: 2.days.ago) }
+
+    it 'returns the project updated_at if most recent' do
+      expect(project.last_edited_at).to eq(project.updated_at)
+    end
+
+    it 'returns the latest component updated_at if most recent' do
+      latest_component = create(:component, project:, updated_at: 1.hour.ago)
+      expect(project.last_edited_at).to eq(latest_component.updated_at)
+    end
+  end
 end

spec/requests/projects/remix_spec.rb

@@ -30,6 +30,28 @@
       authenticated_in_hydra_as(owner)
     end
 
+    describe '#index' do
+      before do
+        create_list(:project, 2, remixed_from_id: original_project.id, user_id: authenticated_user.id)
+      end
+
+      it 'returns success response' do
+        get("/api/projects/#{original_project.identifier}/remixes", headers:)
+        expect(response).to have_http_status(:ok)
+      end
+
+      it 'returns the list of projects' do
+        get("/api/projects/#{original_project.identifier}/remixes", headers:)
+        expect(response.parsed_body.length).to eq(2)
+      end
+
+      it 'returns 404 response if invalid project' do
+        get('/api/projects/no-such-project/remixes', headers:)
+
+        expect(response).to have_http_status(:not_found)
+      end
+    end
+
     describe '#show' do
       before do
         create(:project, remixed_from_id: original_project.id, user_id: authenticated_user.id)