Authorize each lesson in batch create with CanCan's authorize!

Author: PetarSimonovic

app/controllers/api/lessons/batch_controller.rb

@@ -9,13 +9,13 @@ class BatchController < ApiController
       before_action :authorize_user
       before_action :verify_school_class_belongs_to_school
       before_action :verify_can_create_scratch_projects
-      load_and_authorize_resource :lesson
+      before_action :authorize_lesson_projects!
 
       def create_batch
         raise ParameterError, 'lesson_projects cannot be blank' unless lesson_projects?
 
         @results = Lesson::CreateBatch.call(
-          lessons_params: params[:lesson_projects].map { |entry| create_batch_params(entry) }
+          lessons_params: batch_lessons_params
         )
         @user = current_user
         render :create_batch, formats: [:json], status: :created
@@ -38,6 +38,10 @@ def verify_can_create_scratch_projects
         verify_lesson_scratch!(scratch_project_params)
       end
 
+      def batch_lessons_params
+        @batch_lessons_params ||= params[:lesson_projects].map { |lesson_params| create_batch_params(lesson_params) }
+      end
+
       def create_batch_params(lesson_project)
         lesson_project.permit(*LESSON_ATTRIBUTES, :origin_identifier, project_attributes: PROJECT_ATTRIBUTES).merge(user_id: current_user.id)
       end
@@ -48,6 +52,14 @@ def lesson_projects?
 
         projects.any?(&:present?)
       end
+
+      def authorize_lesson_projects!
+        return unless lesson_projects?
+
+        batch_lessons_params.each do |lesson_params|
+          authorize! :create, Lesson.new(lesson_params.slice(:school_id, :school_class_id, :user_id))
+        end
+      end
     end
   end
 end

spec/features/lesson/creating_a_batch_of_lessons_spec.rb

@@ -157,6 +157,32 @@
     end
   end
 
+  context 'when the user does not belong to the school' do
+    let(:other_school) { create(:school, scratch_enabled: true) }
+    let(:lesson_project_params) do
+      [
+        {
+          name: 'Lesson 1',
+          school_id: other_school.id,
+          project_attributes: { name: 'Project 1', project_type: Project::Types::CODE_EDITOR_SCRATCH }
+        },
+        {
+          name: 'Lesson 2',
+          school_id: other_school.id,
+          project_attributes: { name: 'Project 2', project_type: Project::Types::CODE_EDITOR_SCRATCH }
+        }
+      ]
+    end
+
+    it 'responds 403 Forbidden' do
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'does not create any lessons' do
+      expect(Lesson.count).to eq(0)
+    end
+  end
+
   context 'when the school does not have Scratch enabled' do
     let(:scratch_enabled) { false }