Validate that the user association with a project matches the lesson (if present)

With regards to students creating projects relating to a lesson, I think
they should just remix the project created by the teacher and not
associate it with the lesson directly to make it easier to distinguish
which is the actual project for a lesson, rather than a version created
by a student.

Author: tuzz

app/models/project.rb

@@ -17,6 +17,7 @@ class Project < ApplicationRecord
   validate :identifier_cannot_be_taken_by_another_user
   validates :locale, presence: true, unless: :user_id
   validate :user_has_a_role_within_the_school
+  validate :user_is_the_owner_of_the_lesson
 
   scope :internal_projects, -> { where(user_id: nil) }
 
@@ -57,9 +58,15 @@ def user_has_a_role_within_the_school
     _, user = with_user
 
     return if user.blank?
-    return if user.org_roles(organisation_id: school.id).any?
+    return if user.org_roles(organisation_id: school_id).any?
 
-    msg = "'#{user_id}' does not have any roles for for organisation '#{school.id}'"
+    msg = "'#{user_id}' does not have any roles for for organisation '#{school_id}'"
     errors.add(:user, msg)
   end
+
+  def user_is_the_owner_of_the_lesson
+    return if !lesson || user_id == lesson.user_id
+
+    errors.add(:user, "'#{user_id}' is not the owner for lesson '#{lesson_id}'")
+  end
 end

spec/models/lesson_spec.rb

@@ -31,8 +31,9 @@
     end
 
     it 'has many projects' do
-      lesson = create(:lesson, projects: [build(:project), build(:project)])
-      expect(lesson.projects.size).to eq(2)
+      user_id = SecureRandom.uuid
+      lesson = create(:lesson, user_id:, projects: [build(:project, user_id:)])
+      expect(lesson.projects.size).to eq(1)
     end
   end
 

spec/models/project_spec.rb

@@ -76,7 +76,19 @@
         project.update!(school: create(:school))
       end
 
-      it 'requires a user that has a role within the school' do
+      it 'requires that the user that has a role within the school' do
+        project.user_id = SecureRandom.uuid
+        expect(project).to be_invalid
+      end
+    end
+
+    context 'when the project has a lesson' do
+      before do
+        lesson = create(:lesson)
+        project.update!(lesson:, user_id: lesson.user_id, identifier: 'something')
+      end
+
+      it 'requires that the user be the owner of the lesson' do
         project.user_id = SecureRandom.uuid
         expect(project).to be_invalid
       end