Test coverage for the SchoolClass feature

This commit adds broader tests for the behaviour of marked-as-deleted
classes.

Author: fspeirs

spec/features/school_class/deleting_a_school_class_spec.rb

@@ -18,6 +18,11 @@
     expect(response).to have_http_status(:no_content)
   end
 
+  it 'marks the class as deleted instead of destroying it' do
+    delete("/api/schools/#{school.id}/classes/#{school_class.id}", headers:)
+    expect(school_class.reload.deleted?).to be true
+  end
+
   it 'responds 204 No Content when the user is the class teacher' do
     authenticated_in_hydra_as(teacher)
 
@@ -53,4 +58,11 @@
     delete("/api/schools/#{school.id}/classes/#{school_class.id}", headers:)
     expect(response).to have_http_status(:forbidden)
   end
+
+  it 'responds 403 Forbidden when the class is already deleted' do
+    school_class.update!(deleted: true)
+
+    delete("/api/schools/#{school.id}/classes/#{school_class.id}", headers:)
+    expect(response).to have_http_status(:forbidden)
+  end
 end

spec/features/school_class/listing_school_classes_spec.rb

@@ -102,6 +102,30 @@ def create_remix_with_feedback(school_class:, student:, feedback_attrs: [])
       data = get_classes
       expect(data.size).to eq(1)
     end
+
+    it 'does not include deleted classes' do
+      school_class.update!(deleted: true)
+
+      data = get_classes
+      expect(data.pluck(:name)).not_to include('Test School Class')
+    end
+
+    it 'does not include deleted classes for school-teachers' do
+      authenticated_in_hydra_as(teacher)
+      school_class.update!(deleted: true)
+
+      data = get_classes
+      expect(data).to be_empty
+    end
+
+    it 'does not include deleted classes for school-students' do
+      authenticated_in_hydra_as(student)
+      stub_user_info_api_for(teacher)
+      school_class.update!(deleted: true)
+
+      data = get_classes
+      expect(data).to be_empty
+    end
   end
 
   describe 'submitted_count' do

spec/features/school_class/showing_a_school_class_spec.rb

@@ -104,6 +104,31 @@
       get("/api/schools/#{school.id}/classes/#{school_class.id}", headers:)
       expect(response).to have_http_status(:forbidden)
     end
+
+    it 'responds 403 Forbidden when the class is deleted even if student is a member' do
+      student = create(:student, school:)
+      authenticated_in_hydra_as(student)
+      create(:class_student, school_class:, student_id: student.id)
+      school_class.update!(deleted: true)
+
+      get("/api/schools/#{school.id}/classes/#{school_class.id}", headers:)
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'responds 403 Forbidden when the class is deleted even if user is the teacher' do
+      authenticated_in_hydra_as(teacher)
+      school_class.update!(deleted: true)
+
+      get("/api/schools/#{school.id}/classes/#{school_class.id}", headers:)
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'responds 403 Forbidden when the class is deleted even if user is a school owner' do
+      school_class.update!(deleted: true)
+
+      get("/api/schools/#{school.id}/classes/#{school_class.id}", headers:)
+      expect(response).to have_http_status(:forbidden)
+    end
   end
 
   context 'when school and class codes are provided' do
@@ -201,5 +226,30 @@
       get("/api/schools/#{school.code}/classes/#{school_class.code}", headers:)
       expect(response).to have_http_status(:forbidden)
     end
+
+    it 'responds 403 Forbidden when the class is deleted even if student is a member' do
+      student = create(:student, school:)
+      authenticated_in_hydra_as(student)
+      create(:class_student, school_class:, student_id: student.id)
+      school_class.update!(deleted: true)
+
+      get("/api/schools/#{school.code}/classes/#{school_class.code}", headers:)
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'responds 403 Forbidden when the class is deleted even if user is the teacher' do
+      authenticated_in_hydra_as(teacher)
+      school_class.update!(deleted: true)
+
+      get("/api/schools/#{school.code}/classes/#{school_class.code}", headers:)
+      expect(response).to have_http_status(:forbidden)
+    end
+
+    it 'responds 403 Forbidden when the class is deleted even if user is a school owner' do
+      school_class.update!(deleted: true)
+
+      get("/api/schools/#{school.code}/classes/#{school_class.code}", headers:)
+      expect(response).to have_http_status(:forbidden)
+    end
   end
 end

spec/features/school_class/updating_a_school_class_spec.rb

@@ -84,4 +84,11 @@
     put("/api/schools/#{school.id}/classes/#{school_class.id}", headers:, params:)
     expect(response).to have_http_status(:forbidden)
   end
+
+  it 'responds 403 Forbidden when the class is deleted even if user is the teacher' do
+    school_class.update!(deleted: true)
+
+    put("/api/schools/#{school.id}/classes/#{school_class.id}", headers:, params:)
+    expect(response).to have_http_status(:forbidden)
+  end
 end