Allow Experience CS to sync public Scratch projects

[abcampo-iry]

Status

• Partially closes https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1657

• Related to https://github.com/RaspberryPiFoundation/experience-cs/pull/2330

  Points for consideration:

• Security: Only users with the experience-cs-admin role can change the project type and Scratch data for public projects.

• Security: Projects are not yet marked as coming from Experience CS. Until origin tracking is added, only known Experience CS project identifiers should be enabled for synchronization.

What's changed?

• Allow public, localized code_editor_scratch projects to contain instructions. This is a narrow exception to Restrict instructions to school projects (#479) for public Experience CS templates. This may be worth discussing.
• Allow Experience CS admins to change a public project to code_editor_scratch.
• Allow Experience CS admins to create or update Scratch data through the project update endpoint.

Some concerns of mine were to understand the cases:

• Existing ExCS stub with no ScratchComponent -> Create ScratchComponent -> Store the ExCS code -> Change type from scratch to code_editor_scratch

• Existing ExCS project with a ScratchComponent -> Replace its content with the latest ExCS code -> This is intentional because ExCS is the source of truth

• User-owned project -> Cannot be updated by an experience-cs-admin -> Authorization prevents the overwrite

• Unrelated public project with the same identifier -> Could currently be overwritten -> This is the known provenance/origin risk mentioned in the ticket

[github-actions]

Test coverage

92.2% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/31479108559

[Copilot]

Pull request overview

Enables Experience CS administrators to synchronize public, localized Scratch-based templates by allowing updates to project type and Scratch SB3 payloads, and by widening the “instructions” validation exception for public code_editor_scratch projects.

Changes:

• Allow public, localized code_editor_scratch projects to store instructions (model validation change + specs).
• Permit Experience CS admins to update project_type and create/update a project’s ScratchComponent via the projects update endpoint.
• Extend request/feature specs to cover Experience CS admin create/update flows and non-admin restrictions.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
spec/requests/projects/update_spec.rb	Adds coverage for blocking non-admin type/Scratch updates and allowing Experience CS admin updates.
spec/models/project_spec.rb	Verifies validation exception for instructions on public localized code_editor_scratch projects only.
spec/features/project/creating_a_project_spec.rb	Updates Experience CS admin create flow to include instructions + Scratch SB3 payload.
lib/concepts/project/operations/update.rb	Adds support for updating project_type and persisting a ScratchComponent during project update.
app/models/project.rb	Relaxes instructions validation for public localized code_editor_scratch projects.
app/controllers/api/projects_controller.rb	Makes project_type/scratch_component params conditional (create or Experience CS admin).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[zetter-rpf]

Nice one