Fix GET /api/projects/:identifier/remix/identifier returns 404 during a valid student remix flow

[abcampo-iry]

Status

• Closes #1289
• Related to #1294

Points for consideration:

The endpoint now accepts remix identifiers as input for GET /api/projects/:projectIdentifier/remix/identifier, but only returns 200 when the supplied remix belongs to the currentuser. Another user's remix identifier still returns 404.

What's changed?

• Updated GET /api/projects/:projectIdentifier/remix/identifier so it returns the current user’s remix identifier when given either the base project identifier or the user’s remix identifier
• Preserved 404 responses for invalid projects, projects with no remix for the current user, and remix identifiers belonging to another user
• Added request specs for base-project lookup, remix-identifier lookup, and another user’s remix returning 404

Steps to perform after deploying to production

• None

Tested in local alongside: 823

[github-actions]

Test coverage

89.32% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/24995364831

[Copilot]

Pull request overview

Fixes GET /api/projects/:projectIdentifier/remix/identifier returning 404 when the client supplies the current user’s remix identifier (instead of the base/original project identifier) during a valid remix flow.

Changes:

• Split show_identifier loading/authorization into a dedicated before_action that supports either (a) base project identifier lookup or (b) current user’s remix identifier passthrough.
• Preserved 404 behavior for invalid identifiers, users without a remix, and identifiers that belong to another user’s remix.
• Added request specs covering remix-identifier lookup success and “another user’s remix identifier” returning 404.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
spec/requests/projects/remix_spec.rb	Adds request specs for the new identifier resolution behavior and the cross-user 404 case.
app/controllers/api/projects/remixes_controller.rb	Introduces load_and_authorize_remix_identifier and wires it to show_identifier to accept either base or current-user remix identifiers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.