Allow ExCS admin to update starter projects

This gives users with the "experience-cs-admin" role permission to
update starter (or "public") projects (i.e. projects with no `user_id`
set). I've added an example to the "Updating a project" feature spec to
check this works as intended.

Note that in the feature spec, unlike in the other examples, I'm relying
on the lookup via `ProjectLoader#load` which I think is the intended use
(at least from Experience CS) and this is why I've had to set the
project locale to one of the default fallback locales, i.e. 'en', in the
spec setup. I haven't attempted to fix the other examples, but I've
started looking at that in #553 and plan to address the problem
separately.

Author: floehopper

app/models/ability.rb

@@ -106,6 +106,7 @@ def define_experience_cs_admin_abilities(user)
     return unless user&.experience_cs_admin?
 
     can :create, Project
+    can :update, Project
   end
 
   def school_teacher_can_manage_lesson?(user:, school:, lesson:)

spec/features/project/updating_a_project_spec.rb

@@ -10,7 +10,8 @@
   end
 
   let(:headers) { { Authorization: UserProfileMock::TOKEN } }
-  let!(:project) { create(:project, name: 'Test Project', user_id: owner.id) }
+  let(:project_type) { Project::Types::PYTHON }
+  let!(:project) { create(:project, name: 'Test Project', user_id: owner.id, locale: 'en', project_type:) }
   let(:owner) { create(:owner, school:) }
   let(:school) { create(:school) }
 
@@ -53,4 +54,26 @@
     put("/api/projects/#{project.id}", params:)
     expect(response).to have_http_status(:unauthorized)
   end
+
+  context 'when the user is an Experience CS admin and project type is scratch' do
+    let(:experience_cs_admin) { create(:experience_cs_admin_user) }
+    let(:project_type) { Project::Types::SCRATCH }
+    let(:params) { { project: { name: 'Test Project' } } }
+
+    before do
+      authenticated_in_hydra_as(experience_cs_admin)
+    end
+
+    it 'responds 200 OK' do
+      put("/api/projects/#{project.identifier}?project_type=scratch", headers:, params:)
+      expect(response).to have_http_status(:success)
+    end
+
+    it 'sets the project name to the specified value' do
+      put("/api/projects/#{project.identifier}?project_type=scratch", headers:, params:)
+      data = JSON.parse(response.body, symbolize_names: true)
+
+      expect(data[:name]).to eq('Test Project')
+    end
+  end
 end

spec/models/ability_spec.rb

@@ -143,6 +143,7 @@
       let(:user) { build(:experience_cs_admin_user) }
 
       it { is_expected.to be_able_to(:create, starter_project) }
+      it { is_expected.to be_able_to(:update, starter_project) }
     end
 
     # rubocop:disable RSpec/MultipleMemoizedHelpers