Add a project_identifier parameter to LessonController#index (#649)

Experience CS was calling `LessonsController#index` on almost every
Scratch project load, pulling the entire set of Lesson data between the
two systems, and then filtering that array on the Experience CS side to
find a lesson that matched a project identifier.

This commit allows passing a `project_identifier` query parameter to
`LessonsController#show` that will allow Experience CS to query directly
for the lesson it needs.

## Status

- Related to RaspberryPiFoundation/experience-cs#1002 (see [this
comment](RaspberryPiFoundation/experience-cs#1002 (comment)))

## Points for consideration:

- Performance: this change should allow us to make a change in
Experience CS that will massively cut the amount of data being shifted
between the two systems.

## What's changed?

I refactored `LessonsController#index` to further narrow the scope to
projects where a `project_identifier` query parameter was present in the
request. I refactored it to keep Rubocop happy but, essentially, I just
added the line:

`scope = scope.joins(:project).where(projects: { identifier:
params[:project_identifier] }) if params[:project_identifier].present?`

...to the calculation of the scope of Lessons to return.

## Steps to perform after deploying to production

No additional steps required.

Author: fspeirs

app/controllers/api/lessons_controller.rb

@@ -7,12 +7,11 @@ class LessonsController < ApiController
     load_and_authorize_resource :lesson
 
     def index
-      archive_scope = params[:include_archived] == 'true' ? Lesson : Lesson.unarchived
-      scope = params[:school_class_id] ? archive_scope.where(school_class_id: params[:school_class_id]) : archive_scope
-      ordered_scope = scope.order(created_at: :asc)
-
-      accessible_lessons = ordered_scope.accessible_by(current_ability).includes(project: :remixes)
+      accessible_lessons = filtered_lessons_scope
+                           .accessible_by(current_ability)
+                           .includes(project: :remixes)
       @lessons_with_users = accessible_lessons.with_users
+
       if current_user&.school_teacher?(school) || current_user&.school_owner?(school)
         render :teacher_index, formats: [:json], status: :ok
       else
@@ -75,6 +74,13 @@ def destroy
 
     private
 
+    def filtered_lessons_scope
+      archive_scope = params[:include_archived] == 'true' ? Lesson : Lesson.unarchived
+      scope = params[:school_class_id] ? archive_scope.where(school_class_id: params[:school_class_id]) : archive_scope
+      scope = scope.joins(:project).where(projects: { identifier: params[:project_identifier] }) if params[:project_identifier].present?
+      scope.order(created_at: :asc)
+    end
+
     def verify_school_class_belongs_to_school
       return if base_params[:school_class_id].blank?
       return if school&.classes&.pluck(:id)&.include?(base_params[:school_class_id])

spec/features/lesson/listing_lessons_spec.rb

@@ -132,6 +132,49 @@
     expect(data.first[:submitted_count]).to eq(1)
   end
 
+  context 'when filtering by project_identifier' do
+    let!(:other_lesson) { create(:lesson, name: 'Another Lesson', visibility: 'public', user_id: teacher.id) }
+
+    it 'returns only lessons with the matching project identifier' do
+      # Ensure other_lesson exists with a different project
+      expect(other_lesson.project.identifier).not_to eq(lesson.project.identifier)
+
+      get("/api/lessons?project_identifier=#{lesson.project.identifier}", headers:)
+      data = JSON.parse(response.body, symbolize_names: true)
+
+      expect(data.size).to eq(1)
+      expect(data.first[:name]).to eq('Test Lesson')
+      expect(data.first[:project][:identifier]).to eq(lesson.project.identifier)
+    end
+
+    it 'returns empty array when no lesson matches the project identifier' do
+      get('/api/lessons?project_identifier=non-existent-identifier', headers:)
+      data = JSON.parse(response.body, symbolize_names: true)
+
+      expect(data.size).to eq(0)
+    end
+
+    it 'works without authentication' do
+      get("/api/lessons?project_identifier=#{lesson.project.identifier}")
+      data = JSON.parse(response.body, symbolize_names: true)
+
+      expect(response).to have_http_status(:ok)
+      expect(data.size).to eq(1)
+      expect(data.first[:name]).to eq('Test Lesson')
+    end
+
+    it 'can be combined with school_class_id filter' do
+      lesson.update!(school_class_id: school_class.id)
+      other_lesson.update!(school_class_id: school_class.id)
+
+      get("/api/lessons?school_class_id=#{school_class.id}&project_identifier=#{lesson.project.identifier}", headers:)
+      data = JSON.parse(response.body, symbolize_names: true)
+
+      expect(data.size).to eq(1)
+      expect(data.first[:name]).to eq('Test Lesson')
+    end
+  end
+
   context "when the lesson's visibility is 'private'" do
     let!(:lesson) { create(:lesson, name: 'Test Lesson', visibility: 'private') }
     let(:owner) { create(:owner, school:) }