Fix GET /api/projects/:identifier/remix/identifier returns 404 during a valid student remix flow

app/controllers/api/projects/remixes_controller.rb

@@ -7,7 +7,8 @@ class RemixesController < ApiController
 
       before_action :authorize_user
       load_and_authorize_resource :school, only: :index
-      before_action :load_and_authorize_remix, only: %i[show show_identifier]
+      before_action :load_and_authorize_remix, only: :show
+      before_action :load_and_authorize_remix_identifier, only: :show_identifier
 
       def index
         projects = Project.where(remixed_from_id: project.id).accessible_by(current_ability)
@@ -52,6 +53,19 @@ def load_and_authorize_remix
         authorize! :show, @project
       end
 
+      def load_and_authorize_remix_identifier
+        @project =
+          if project.remixed_from_id.present?
+            project if project.user_id == current_user.id
+          else
+            remix_for_user(project, current_user)
+          end
+
+        raise ActiveRecord::RecordNotFound unless @project
+
+        authorize! :show, @project
+      end
+
       def remix_params
         params.require(:project)
               .permit(:name,

spec/requests/projects/remix_spec.rb

@@ -106,6 +106,12 @@
         expect(response.parsed_body['identifier']).to eq(remixed_project.identifier)
       end
 
+      it 'returns the supplied identifier when it already belongs to the user remix' do
+        get("/api/projects/#{remixed_project.identifier}/remix/identifier", headers:)
+        expect(response).to have_http_status(:ok)
+        expect(response.parsed_body['identifier']).to eq(remixed_project.identifier)
+      end
+
       it 'returns 404 response if invalid project' do
         get('/api/projects/no-such-project/remix/identifier', headers:)
         expect(response).to have_http_status(:not_found)
@@ -119,6 +125,17 @@
         expect(response).to have_http_status(:not_found)
       end
 
+      it 'returns 404 if the supplied remix identifier belongs to another user' do
+        another_user_remix = create(
+          :project,
+          remixed_from_id: original_project.id,
+          user_id: create(:owner, school:).id
+        )
+
+        get("/api/projects/#{another_user_remix.identifier}/remix/identifier", headers:)
+        expect(response).to have_http_status(:not_found)
+      end
+
       context 'when multiple remixes exist for the same user and project' do
         let!(:oldest_remix) do
           create(:project, remixed_from_id: original_project.id, user_id: authenticated_user.id,