Restrict instructions to school projects - #479
Merged
Merged
Conversation
raspberrypiherokubot
temporarily deployed
to
editor-api-p-restrict-i-zi3sgd
January 20, 2025 14:26
Inactive
conorriches
approved these changes
Jan 28, 2025
abcampo-iry
added a commit
that referenced
this pull request
Aug 11, 2026
## Status - Partially closes RaspberryPiFoundation/digital-editor-issues#1657 - Related to RaspberryPiFoundation/experience-cs#2330 ## Points for consideration: - Security: Only users with the `experience-cs-admin` role can change the project type and Scratch data for public projects. - Security: Projects are not yet marked as coming from Experience CS. Until origin tracking is added, only known Experience CS project identifiers should be enabled for synchronization. ## What's changed? - Allow public, localized `code_editor_scratch` projects to contain instructions. This is a narrow exception to [Restrict instructions to school projects (#479)](#479) for public Experience CS templates. This may be worth discussing. - Allow Experience CS admins to change a public project to `code_editor_scratch`. - Allow Experience CS admins to create or update Scratch data through the project update endpoint. Some concerns of mine were to understand the cases: - Existing ExCS stub with no ScratchComponent -> Create ScratchComponent -> Store the ExCS code -> Change type from scratch to code_editor_scratch - Existing ExCS project with a ScratchComponent -> Replace its content with the latest ExCS code -> This is intentional because ExCS is the source of truth - User-owned project -> Cannot be updated by an experience-cs-admin -> Authorization prevents the overwrite - Unrelated public project with the same identifier -> Could currently be overwritten -> This is the known provenance/origin risk mentioned in the ticket
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's changed?
projectmodel to stop instructions being added to non-school projectscloses https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/393