Restrict teacher ability so that they can only access their own class projects

[cocomarine]

Status

• Part of https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/526

What's changed?

• Fixed a bug where teachers could access projects in school classes they don't belong to by adding class membership check to the project rule in school teacher abilities.

[github-actions]

Test coverage

92.04% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/28385120645

[Copilot]

Pull request overview

This PR tightens CanCanCan authorization for school teachers so they can only access (read/update/show_context) lesson projects that belong to school classes they teach, preventing cross-class project access within the same school.

Changes:

• Restrict define_school_teacher_abilities project access to lessons whose school_class includes the current teacher.
• Update ability specs to assert that a teacher in the same school (but not in the class) cannot access another teacher’s class project.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
spec/models/ability_spec.rb	Updates expectations to ensure non-class teachers in the same school cannot read/show_context/update class lesson projects.
app/models/ability.rb	Adds a school class membership constraint to teacher permissions for lesson projects visible to teachers/students.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zetter-rpf]

Nice one