Add ExCS projects in bulk

[cocomarine]

Status

• Part of https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1755

What's changed?

• Moved find_source_project! from LessonsController to LessonCreation so both the single and batch controllers can share it.
• lib/concepts/lesson/operations/create_batch.rb:
  • call now accepts source_projects: (defaults to []), zips it with lessons_params, and threads each resolved project into Lesson::Create.call(..., source_project:).
• app/controllers/api/lessons/batch_controller.rb:
  • create_batch_params now permits source_project_identifier per row.
  • batch_source_projects resolves each row's identifier to a Project (or nil)
  • verify_can_create_scratch_projects now checks every row (not just the first scratch-typed one) against that row's resolved source_project
  • New authorize_source_projects! before_action calls authorize! :show on each resolved source project.
  • create_batch passes source_projects: batch_source_projects through to Lesson::CreateBatch.call.

[github-actions]

Test coverage

93.52% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/33866689597

[Copilot]

🟡 Changes recommended

The batch controller currently resolves all source projects eagerly during the Scratch check and can continue running callbacks after rendering, which can change error precedence (e.g., 403 vs 422) and override an intended response.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds support for creating lessons in bulk where individual rows can optionally remix from an existing Experience CS Scratch source project, ensuring the batch endpoint resolves, authorizes, and forwards per-row source projects through the lesson creation pipeline.

Changes:

• Thread per-row source_project_identifier through Lesson::CreateBatch into Lesson::Create as source_project.
• Add batch controller support for permitting, resolving, Scratch-gating, and authorizing source projects per row.
• Add feature + concept specs covering remix rows, missing sources, and Scratch-disabled enforcement.

File summaries

File	Description
spec/features/lesson/creating_a_batch_of_lessons_spec.rb	Adds end-to-end coverage for batch rows that remix from a source project and for failure modes (missing source, Scratch disabled).
spec/concepts/lesson/create_batch_spec.rb	Ensures Lesson::CreateBatch correctly applies a provided source project only to the corresponding row.
lib/concepts/lesson/operations/create_batch.rb	Extends batch operation to accept source_projects: and forward the per-row source_project into lesson creation.
app/controllers/concerns/lesson_creation.rb	Moves find_source_project! into shared concern so single + batch lesson creation can reuse it.
app/controllers/api/lessons/batch_controller.rb	Permits source_project_identifier, resolves per-row source projects, enforces Scratch rules per row, and authorizes source projects.
app/controllers/api/lessons_controller.rb	Removes the now-shared find_source_project! method from the single-create controller.

Review details

Suppressed comments (1)

app/controllers/api/lessons/batch_controller.rb:80

• If a previous before_action has already rendered a response (e.g., Scratch-disabled check), this before_action can still run and resolve/authorize source projects, which can raise and override the intended response. Add a performed? guard so callbacks stop doing work once a response is committed.

      def authorize_source_projects!
        return unless lesson_projects?

        batch_source_projects.compact.each { |source_project| authorize! :show, source_project }
      end

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.