Skip to content

Commit 13d098a

Browse files
chrisrooschrisroos
committed
Create Safeguarding flags in SchoolStudentsController
The Profile API requires that the authenticated user has: - either the school:owner or school:teacher safeguarding flags set in order to be able to create, edit and list students - the school:owner safeguarding flag set in order to be able to delete students Safeguarding flags can only be set in Profile API for the authenticated user so we're conditionally creating them here before the user then attempts to interact with Profile API to CRUD students.
1 parent 7a9ff1d commit 13d098a

7 files changed

+163
-0
lines changed

‎app/controllers/api/school_students_controller.rb

+24
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ class SchoolStudentsController < ApiController
55
before_action :authorize_user
66
load_and_authorize_resource :school
77
authorize_resource :school_student, class: false
8+
before_action :create_safeguarding_flags
89

910
def index
1011
result = SchoolStudent::List.call(school: @school, token: current_user.token)
@@ -62,5 +63,28 @@ def destroy
6263
def school_student_params
6364
params.require(:school_student).permit(:username, :password, :name)
6465
end
66+
67+
def create_safeguarding_flags
68+
create_teacher_safeguarding_flag
69+
create_owner_safeguarding_flag
70+
end
71+
72+
def create_teacher_safeguarding_flag
73+
return unless current_user.school_teacher?(@school)
74+
75+
ProfileApiClient.create_safeguarding_flag(
76+
token: current_user.token,
77+
flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher]
78+
)
79+
end
80+
81+
def create_owner_safeguarding_flag
82+
return unless current_user.school_owner?(@school)
83+
84+
ProfileApiClient.create_safeguarding_flag(
85+
token: current_user.token,
86+
flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner]
87+
)
88+
end
6589
end
6690
end

‎spec/features/school_student/creating_a_batch_of_school_students_spec.rb

+27
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
before do
77
authenticated_in_hydra_as(owner)
88
stub_profile_api_create_school_student
9+
stub_profile_api_create_safeguarding_flag
910
end
1011

1112
let(:headers) { { Authorization: UserProfileMock::TOKEN } }
@@ -15,6 +16,16 @@
1516

1617
let(:file) { fixture_file_upload('students.csv') }
1718

19+
it 'creates the school owner safeguarding flag' do
20+
post("/api/schools/#{school.id}/students/batch", headers:, params: { file: })
21+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
22+
end
23+
24+
it 'does not create the school teacher safeguarding flag' do
25+
post("/api/schools/#{school.id}/students/batch", headers:, params: { file: })
26+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
27+
end
28+
1829
it 'responds 204 No Content' do
1930
post("/api/schools/#{school.id}/students/batch", headers:, params: { file: })
2031
expect(response).to have_http_status(:no_content)
@@ -28,6 +39,22 @@
2839
expect(response).to have_http_status(:no_content)
2940
end
3041

42+
it 'does not create the school owner safeguarding flag when the user is a school-teacher' do
43+
teacher = create(:teacher, school:)
44+
authenticated_in_hydra_as(teacher)
45+
46+
post("/api/schools/#{school.id}/students/batch", headers:, params: { file: })
47+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
48+
end
49+
50+
it 'creates the school teacher safeguarding flag when the user is a school-teacher' do
51+
teacher = create(:teacher, school:)
52+
authenticated_in_hydra_as(teacher)
53+
54+
post("/api/schools/#{school.id}/students/batch", headers:, params: { file: })
55+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
56+
end
57+
3158
it 'responds 422 Unprocessable Entity when params are invalid' do
3259
post("/api/schools/#{school.id}/students/batch", headers:, params: {})
3360
expect(response).to have_http_status(:unprocessable_entity)

‎spec/features/school_student/creating_a_school_student_spec.rb

+27
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
before do
77
authenticated_in_hydra_as(owner)
88
stub_profile_api_create_school_student
9+
stub_profile_api_create_safeguarding_flag
910
end
1011

1112
let(:headers) { { Authorization: UserProfileMock::TOKEN } }
@@ -22,6 +23,16 @@
2223
}
2324
end
2425

26+
it 'creates the school owner safeguarding flag' do
27+
post("/api/schools/#{school.id}/students", headers:, params:)
28+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
29+
end
30+
31+
it 'does not create the school teacher safeguarding flag' do
32+
post("/api/schools/#{school.id}/students", headers:, params:)
33+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
34+
end
35+
2536
it 'responds 204 No Content' do
2637
post("/api/schools/#{school.id}/students", headers:, params:)
2738
expect(response).to have_http_status(:no_content)
@@ -35,6 +46,22 @@
3546
expect(response).to have_http_status(:no_content)
3647
end
3748

49+
it 'does not create the school owner safeguarding flag when the user is a school teacher' do
50+
teacher = create(:teacher, school:)
51+
authenticated_in_hydra_as(teacher)
52+
53+
post("/api/schools/#{school.id}/students", headers:, params:)
54+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
55+
end
56+
57+
it 'creates the school teacher safeguarding flag when the user is a school teacher' do
58+
teacher = create(:teacher, school:)
59+
authenticated_in_hydra_as(teacher)
60+
61+
post("/api/schools/#{school.id}/students", headers:, params:)
62+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
63+
end
64+
3865
it 'responds 400 Bad Request when params are missing' do
3966
post("/api/schools/#{school.id}/students", headers:)
4067
expect(response).to have_http_status(:bad_request)

‎spec/features/school_student/deleting_a_school_student_spec.rb

+27
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,24 @@
66
before do
77
authenticated_in_hydra_as(owner)
88
stub_profile_api_delete_school_student
9+
stub_profile_api_create_safeguarding_flag
910
end
1011

1112
let(:headers) { { Authorization: UserProfileMock::TOKEN } }
1213
let(:school) { create(:school) }
1314
let(:student_id) { SecureRandom.uuid }
1415
let(:owner) { create(:owner, school:) }
1516

17+
it 'creates the school owner safeguarding flag' do
18+
delete("/api/schools/#{school.id}/students/#{student_id}", headers:)
19+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
20+
end
21+
22+
it 'does not create the school teacher safeguarding flag' do
23+
delete("/api/schools/#{school.id}/students/#{student_id}", headers:)
24+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
25+
end
26+
1627
it 'responds 204 No Content' do
1728
delete("/api/schools/#{school.id}/students/#{student_id}", headers:)
1829
expect(response).to have_http_status(:no_content)
@@ -39,6 +50,22 @@
3950
expect(response).to have_http_status(:forbidden)
4051
end
4152

53+
it 'does not create the school owner safeguarding flag when logged in as a teacher' do
54+
teacher = create(:teacher, school:)
55+
authenticated_in_hydra_as(teacher)
56+
57+
delete("/api/schools/#{school.id}/students/#{student_id}", headers:)
58+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
59+
end
60+
61+
it 'does not create the school teacher safeguarding flag when logged in as a teacher' do
62+
teacher = create(:teacher, school:)
63+
authenticated_in_hydra_as(teacher)
64+
65+
delete("/api/schools/#{school.id}/students/#{student_id}", headers:)
66+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
67+
end
68+
4269
it 'responds 403 Forbidden when the user is a school-student' do
4370
student = create(:student, school:)
4471
authenticated_in_hydra_as(student)

‎spec/features/school_student/listing_school_students_spec.rb

+27
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
authenticated_in_hydra_as(owner)
88
stub_profile_api_list_school_students(user_id: student.id)
99
stub_user_info_api_for(student)
10+
stub_profile_api_create_safeguarding_flag
1011
end
1112

1213
let(:headers) { { Authorization: UserProfileMock::TOKEN } }
@@ -19,6 +20,16 @@
1920
expect(response).to have_http_status(:ok)
2021
end
2122

23+
it 'creates the school owner safeguarding flag' do
24+
get("/api/schools/#{school.id}/students", headers:)
25+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
26+
end
27+
28+
it 'does not create the school teacher safeguarding flag' do
29+
get("/api/schools/#{school.id}/students", headers:)
30+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
31+
end
32+
2233
it 'responds 200 OK when the user is a school-teacher' do
2334
teacher = create(:teacher, school:)
2435
authenticated_in_hydra_as(teacher)
@@ -27,6 +38,22 @@
2738
expect(response).to have_http_status(:ok)
2839
end
2940

41+
it 'does not create the school owner safeguarding flag when the user is a school teacher' do
42+
teacher = create(:teacher, school:)
43+
authenticated_in_hydra_as(teacher)
44+
45+
get("/api/schools/#{school.id}/students", headers:)
46+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
47+
end
48+
49+
it 'creates the school teacher safeguarding flag when the user is a school teacher' do
50+
teacher = create(:teacher, school:)
51+
authenticated_in_hydra_as(teacher)
52+
53+
get("/api/schools/#{school.id}/students", headers:)
54+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
55+
end
56+
3057
it 'responds with the school students JSON' do
3158
get("/api/schools/#{school.id}/students", headers:)
3259
data = JSON.parse(response.body, symbolize_names: true)

‎spec/features/school_student/updating_a_school_student_spec.rb

+27
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
before do
77
authenticated_in_hydra_as(owner)
88
stub_profile_api_update_school_student
9+
stub_profile_api_create_safeguarding_flag
910
end
1011

1112
let(:headers) { { Authorization: UserProfileMock::TOKEN } }
@@ -23,6 +24,16 @@
2324
}
2425
end
2526

27+
it 'creates the school owner safeguarding flag' do
28+
put("/api/schools/#{school.id}/students/#{student_id}", headers:, params:)
29+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
30+
end
31+
32+
it 'does not create the school teacher safeguarding flag' do
33+
put("/api/schools/#{school.id}/students/#{student_id}", headers:, params:)
34+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
35+
end
36+
2637
it 'responds 204 No Content' do
2738
put("/api/schools/#{school.id}/students/#{student_id}", headers:, params:)
2839
expect(response).to have_http_status(:no_content)
@@ -36,6 +47,22 @@
3647
expect(response).to have_http_status(:no_content)
3748
end
3849

50+
it 'does not create the school owner safeguarding flag when the user is a school teacher' do
51+
teacher = create(:teacher, school:)
52+
authenticated_in_hydra_as(teacher)
53+
54+
put("/api/schools/#{school.id}/students/#{student_id}", headers:, params:)
55+
expect(ProfileApiClient).not_to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:owner])
56+
end
57+
58+
it 'creates the school teacher safeguarding flag when the user is a school teacher' do
59+
teacher = create(:teacher, school:)
60+
authenticated_in_hydra_as(teacher)
61+
62+
put("/api/schools/#{school.id}/students/#{student_id}", headers:, params:)
63+
expect(ProfileApiClient).to have_received(:create_safeguarding_flag).with(token: UserProfileMock::TOKEN, flag: ProfileApiClient::SAFEGUARDING_FLAGS[:teacher])
64+
end
65+
3966
it 'responds 401 Unauthorized when no token is given' do
4067
put("/api/schools/#{school.id}/students/#{student_id}", params:)
4168
expect(response).to have_http_status(:unauthorized)

‎spec/support/profile_api_mock.rb

+4
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,8 @@ def stub_profile_api_update_school_student
3838
def stub_profile_api_delete_school_student
3939
allow(ProfileApiClient).to receive(:delete_school_student)
4040
end
41+
42+
def stub_profile_api_create_safeguarding_flag
43+
allow(ProfileApiClient).to receive(:create_safeguarding_flag)
44+
end
4145
end

0 commit comments

Comments
 (0)