show project owner and other details when levelbuilders view projects

[davidsbailey]

Description

show project owner username, storage owner id and storage app id when levelbuilders view projects.

Screenshot

Scenarios

times we have needed this lately:

• Josh S receives a report that a project is abusive, and needs the project owner to assume identity
• data loss is reported on a certain project, and we need the storage id / storage app id to find the project in S3
• a project that should be frozen is not frozen, and we need to find the level builder who owns it so they can freeze it

other notes

• this info only appears when params[:channel_id] is set, which is on the following routes:

  code-dot-org/dashboard/config/routes.rb

  Lines 164 to 166 in baaa1c3

  	get "/#{key}/:channel_id", to: 'projects#show', key: key.to_s, as: "#{key}_project_share", share: true
  	get "/#{key}/:channel_id/edit", to: 'projects#edit', key: key.to_s, as: "#{key}_project_edit"
  	get "/#{key}/:channel_id/view", to: 'projects#show', key: key.to_s, as: "#{key}_project_view", readonly: true

  . notably, this info is not shown when viewing a script level that is project-backed (example). in this scenario, anyone can run dashboard.project.getShareUrl() from the Chrome Debugger prompt to get the project share link, and this info will be available when they go to that link.
• it is important to never send this info down to the client for non-privileged users, because we don't want non-privileged users to be able to see who owns a project.

[epeach]

Is this needed?

[epeach]

One question about permissions/security: Are we okay with all levelbuilders being able to see the storage ids?

[davidsbailey]

I've changed this to only be visible to project validators. Per offline discussion:

1. we do not currently have any plans to give project validator permissions to anyone outside code.org
2. if we need to give project-related permissions to someone outside code.org in the future, we should rename the project_validator permission to project_admin, and then create a new permission for outside people to receive.

[epeach]

Looks great!

[davidsbailey]

Moved some things around and added a link to sources in S3: