Skip to content

Implement class join codes#789

Draft
fspeirs wants to merge 17 commits intomainfrom
fs-implement-class-join-codes
Draft

Implement class join codes#789
fspeirs wants to merge 17 commits intomainfrom
fs-implement-class-join-codes

Conversation

@fspeirs
Copy link
Copy Markdown
Contributor

@fspeirs fspeirs commented Apr 22, 2026

This PR implements join code functionality for school classes, allowing students to join classes using a unique 6-character code.

Changes

  • Add join_code column to school_classes table
  • Implement JoinCodeGenerator utility for generating unique join codes
  • Add join code functionality to SchoolClass model with automatic generation and regeneration
  • Create join endpoint (/api/classes/join) for class enrollment via join codes
  • Add regenerate join code endpoint (PATCH /api/school_classes/:id/regenerate_join_code)
  • Expose join_code in school class API responses
  • Fix authentication flow to preserve join codes through login redirect
  • Add comprehensive test coverage for all new functionality
  • Update CanCan abilities for join code permissions

@cla-bot cla-bot Bot added the cla-signed label Apr 22, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 22, 2026

Test coverage

89.64% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/25496417639

Comment thread spec/models/school_class_spec.rb Fixed
@fspeirs fspeirs force-pushed the fs-implement-class-join-codes branch from 2b3e115 to bb23e12 Compare April 22, 2026 12:43
PetarSimonovic and others added 16 commits April 30, 2026 17:37
Add a migration to create the school_email_domains table, storing a domain string against a school_id
Create the model and add initial specs
Removing leading @ symbols and lower case domains
Generate human-readable globally unique class join codes in the
format CVDDCVDD (e.g. CE18LI80) — consonant, vowel, two digits,
twice. The mixed alpha+numeric layout reads cleanly out loud,
limits visual ambiguity (no I/1 or O/0 collisions in the consonant
set), and is short enough to type from memory.

Removes K, X, and Z from the consonant pool to reduce the chance of
generating offensive substrings, and rejects any code whose
consonant-vowel pairs match a small denylist of common offensive
patterns. Generation retries up to 100 times before giving up.
Add a globally unique, regenerable join code to every class. The
code is generated automatically on creation and backfilled for
existing classes. Distinct from the existing per-school code:
join codes are globally unique (so /join/:code can resolve without
a school identifier), are designed to be regeneratable if a class
needs a fresh code, and are surfaced in the school_class JSON
payload for clients that display them.

Two migrations following the existing pattern for the per-school
code field — one to add the column and unique index, one to
backfill existing rows. The backfill skips validations because
existing rows may not satisfy other newer constraints.
Add POST /api/schools/:school_id/classes/:id/regenerate_join_code
so teachers and school owners can rotate a class's join code if
it has been over-shared. The endpoint authorises through CanCan;
both school_owner and school_teacher abilities gain the
regenerate_join_code permission for classes they have access to.
Add a public predicate that answers whether an email address
belongs to one of the school's allowed domains. Extracts the
domain from the email (after the last '@', stripped and
lowercased) and delegates to the existing valid_domain? lookup
against school_email_domains. Returns false for blank, malformed,
or domain-less inputs.

Lets callers gate behaviour on email domain without having to
parse the address themselves.
@fspeirs fspeirs force-pushed the fs-implement-class-join-codes branch from 9445787 to 508b98b Compare May 7, 2026 12:35
Add the student-facing half of the join-code flow: a JSON API the
frontend can call to look up a class from its join code and enroll
the current user. Mirrors the teacher_invitations pattern — backend
is JSON-only, the frontend owns the public URL the user lands on.

GET /api/join/:join_code is unauthenticated and returns
{ status, school, school_class } where status is one of
unauthenticated, joinable, already_member, wrong_school, or
domain_mismatch. The frontend uses status to decide what to show.

POST /api/join/:join_code requires auth and performs enrollment.
On success or for already_member it returns
{ redirect_url } (a locale-less path so the frontend can prepend
the user's current locale); on a forbidden status it returns 403
with the status as the error. Membership creation is idempotent.

The endpoint normalises join codes by uppercasing and stripping
non-alphanumerics, so hyphenated forms like BAFA-1234 from
copy-and-pasted share links resolve to the canonical BAFA1234.
@fspeirs fspeirs force-pushed the fs-implement-class-join-codes branch from 508b98b to aec7f84 Compare May 7, 2026 12:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants