From d8e49d701cfaa5248198446fd8a28a56258dbc06 Mon Sep 17 00:00:00 2001
From: Lois Wells <lois.wells@raspberrypi.org>
Date: Mon, 2 Dec 2024 14:36:22 +0000
Subject: [PATCH 01/14] renaming lesson project and student remixes

---
 lib/concepts/lesson/operations/update.rb | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/concepts/lesson/operations/update.rb b/lib/concepts/lesson/operations/update.rb
index 8f4de6c02..b698bcb51 100644
--- a/lib/concepts/lesson/operations/update.rb
+++ b/lib/concepts/lesson/operations/update.rb
@@ -8,6 +8,10 @@ def call(lesson:, lesson_params:)
         response[:lesson] = lesson
         response[:lesson].assign_attributes(lesson_params)
         response[:lesson].save!
+        if lesson_params[:name].present?
+          rename_lesson_project(lesson: response[:lesson], name: lesson_params[:name])
+          rename_lesson_remixes(lesson: response[:lesson], name: lesson_params[:name])
+        end
         response
       rescue StandardError => e
         Sentry.capture_exception(e)
@@ -15,6 +19,17 @@ def call(lesson:, lesson_params:)
         response[:error] = "Error updating lesson: #{errors}"
         response
       end
+
+      def rename_lesson_project(lesson:, name:)
+        lesson.project.update!(name: name)
+      end
+
+      def rename_lesson_remixes(lesson:, name:)
+        lesson_remixes = Project.where(remixed_from_id: lesson.project.id)
+        lesson_remixes.each do |remix|
+          remix.update!(name: name)
+        end
+      end
     end
   end
 end

From 972f1cd7d5734c1b184f1d5ef37470698da443e1 Mon Sep 17 00:00:00 2001
From: Lois Wells <lois.wells@raspberrypi.org>
Date: Mon, 2 Dec 2024 14:37:38 +0000
Subject: [PATCH 02/14] fixing rubocop

---
 lib/concepts/lesson/operations/update.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/concepts/lesson/operations/update.rb b/lib/concepts/lesson/operations/update.rb
index b698bcb51..8cdc3f4be 100644
--- a/lib/concepts/lesson/operations/update.rb
+++ b/lib/concepts/lesson/operations/update.rb
@@ -21,13 +21,13 @@ def call(lesson:, lesson_params:)
       end
 
       def rename_lesson_project(lesson:, name:)
-        lesson.project.update!(name: name)
+        lesson.project.update!(name:)
       end
 
       def rename_lesson_remixes(lesson:, name:)
         lesson_remixes = Project.where(remixed_from_id: lesson.project.id)
         lesson_remixes.each do |remix|
-          remix.update!(name: name)
+          remix.update!(name:)
         end
       end
     end

From 1caa3e818cbd328ca7107e7a616686e11104cd44 Mon Sep 17 00:00:00 2001
From: Lois Wells <lois.wells@raspberrypi.org>
Date: Tue, 3 Dec 2024 11:09:03 +0000
Subject: [PATCH 03/14] ordering listed lessons by created_at timestamp

---
 app/controllers/api/lessons_controller.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/controllers/api/lessons_controller.rb b/app/controllers/api/lessons_controller.rb
index 6ba0c8525..9fb7656c2 100644
--- a/app/controllers/api/lessons_controller.rb
+++ b/app/controllers/api/lessons_controller.rb
@@ -9,7 +9,8 @@ class LessonsController < ApiController
     def index
       archive_scope = params[:include_archived] == 'true' ? Lesson : Lesson.unarchived
       scope = params[:school_class_id] ? archive_scope.where(school_class_id: params[:school_class_id]) : archive_scope
-      @lessons_with_users = scope.accessible_by(current_ability).with_users
+      ordered_scope = scope.order(created_at: :asc)
+      @lessons_with_users = ordered_scope.accessible_by(current_ability).with_users
       render :index, formats: [:json], status: :ok
     end
 

From 8750d52edac8d4f15092a1ccbcf49c68d72ce3b4 Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Tue, 3 Dec 2024 12:40:23 +0000
Subject: [PATCH 04/14] minor test changes to updating_a_lesson_spec

---
 app/models/project.rb                          |  4 ++--
 spec/features/lesson/updating_a_lesson_spec.rb | 14 ++++++++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/app/models/project.rb b/app/models/project.rb
index 69599fb6f..ecb6a3ab2 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -80,8 +80,8 @@ def user_has_a_role_within_the_school
   end
 
   def user_is_a_member_or_the_owner_of_the_lesson
-    return if !lesson || user_id == lesson.user_id || lesson.school_class.members.exists?(student_id: user_id)
-
+    return if !lesson || user_id == lesson.user_id || (lesson.school_class && lesson.school_class.members.exists?(student_id: user_id))
+  
     errors.add(:user, "'#{user_id}' is not the owner or a member of the lesson '#{lesson_id}'")
   end
 end
diff --git a/spec/features/lesson/updating_a_lesson_spec.rb b/spec/features/lesson/updating_a_lesson_spec.rb
index b43f04e53..5d7e6c109 100644
--- a/spec/features/lesson/updating_a_lesson_spec.rb
+++ b/spec/features/lesson/updating_a_lesson_spec.rb
@@ -9,10 +9,16 @@
   end
 
   let(:headers) { { Authorization: UserProfileMock::TOKEN } }
-  let!(:lesson) { create(:lesson, name: 'Test Lesson', user_id: owner.id) }
+  let(:lesson) { build(:lesson, name: 'Test Lesson', user_id: owner.id) }
   let(:owner) { create(:owner, school:, name: 'School Owner') }
   let(:teacher) { create(:teacher, school:) }
   let(:school) { create(:school) }
+  let(:project) { create(:project) }
+
+  before do
+    lesson
+    project.update!(lesson:, school:, user_id: lesson.user_id, identifier: 'something')
+  end
 
   let(:params) do
     {
@@ -60,7 +66,11 @@
 
   context 'when the lesson is associated with a school (library)' do
     let(:school) { create(:school) }
-    let!(:lesson) { create(:lesson, school:, name: 'Test Lesson', visibility: 'teachers', user_id: teacher.id) }
+    let(:lesson) { build(:lesson, school:, name: 'Test Lesson', visibility: 'teachers', user_id: teacher.id) }
+
+    before do
+      lesson
+    end
 
     it 'responds 200 OK when the user is a school-owner' do
       put("/api/lessons/#{lesson.id}", headers:, params:)

From 4e07b5e527da26b929b6a6511195e92b8b09a478 Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Tue, 3 Dec 2024 13:35:48 +0000
Subject: [PATCH 05/14] rubocop

---
 app/models/project.rb                          |  2 +-
 spec/features/lesson/updating_a_lesson_spec.rb | 15 +++++++--------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/app/models/project.rb b/app/models/project.rb
index ecb6a3ab2..aff7aa396 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -81,7 +81,7 @@ def user_has_a_role_within_the_school
 
   def user_is_a_member_or_the_owner_of_the_lesson
     return if !lesson || user_id == lesson.user_id || (lesson.school_class && lesson.school_class.members.exists?(student_id: user_id))
-  
+
     errors.add(:user, "'#{user_id}' is not the owner or a member of the lesson '#{lesson_id}'")
   end
 end
diff --git a/spec/features/lesson/updating_a_lesson_spec.rb b/spec/features/lesson/updating_a_lesson_spec.rb
index 5d7e6c109..fef43761c 100644
--- a/spec/features/lesson/updating_a_lesson_spec.rb
+++ b/spec/features/lesson/updating_a_lesson_spec.rb
@@ -9,6 +9,13 @@
   end
 
   let(:headers) { { Authorization: UserProfileMock::TOKEN } }
+  let(:params) do
+    {
+      lesson: {
+        name: 'New Name'
+      }
+    }
+  end
   let(:lesson) { build(:lesson, name: 'Test Lesson', user_id: owner.id) }
   let(:owner) { create(:owner, school:, name: 'School Owner') }
   let(:teacher) { create(:teacher, school:) }
@@ -20,14 +27,6 @@
     project.update!(lesson:, school:, user_id: lesson.user_id, identifier: 'something')
   end
 
-  let(:params) do
-    {
-      lesson: {
-        name: 'New Name'
-      }
-    }
-  end
-
   it 'responds 200 OK' do
     put("/api/lessons/#{lesson.id}", headers:, params:)
     expect(response).to have_http_status(:ok)

From 874ef29d46514103cb0fa588b8f5d24e39c1a447 Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Tue, 3 Dec 2024 13:37:28 +0000
Subject: [PATCH 06/14] rubocop

---
 app/models/project.rb                          | 2 +-
 spec/features/lesson/updating_a_lesson_spec.rb | 7 ++-----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/app/models/project.rb b/app/models/project.rb
index aff7aa396..f7e49a443 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -80,7 +80,7 @@ def user_has_a_role_within_the_school
   end
 
   def user_is_a_member_or_the_owner_of_the_lesson
-    return if !lesson || user_id == lesson.user_id || (lesson.school_class && lesson.school_class.members.exists?(student_id: user_id))
+    return if !lesson || user_id == lesson.user_id || lesson.school_class&.members&.exists?(student_id: user_id)
 
     errors.add(:user, "'#{user_id}' is not the owner or a member of the lesson '#{lesson_id}'")
   end
diff --git a/spec/features/lesson/updating_a_lesson_spec.rb b/spec/features/lesson/updating_a_lesson_spec.rb
index fef43761c..cfc3c4165 100644
--- a/spec/features/lesson/updating_a_lesson_spec.rb
+++ b/spec/features/lesson/updating_a_lesson_spec.rb
@@ -3,11 +3,6 @@
 require 'rails_helper'
 
 RSpec.describe 'Updating a lesson', type: :request do
-  before do
-    authenticated_in_hydra_as(owner)
-    stub_user_info_api_for(teacher)
-  end
-
   let(:headers) { { Authorization: UserProfileMock::TOKEN } }
   let(:params) do
     {
@@ -23,6 +18,8 @@
   let(:project) { create(:project) }
 
   before do
+    authenticated_in_hydra_as(owner)
+    stub_user_info_api_for(teacher)
     lesson
     project.update!(lesson:, school:, user_id: lesson.user_id, identifier: 'something')
   end

From cb35d7e26be7533443168e24a86bd1a2f429d6ac Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Tue, 3 Dec 2024 14:47:01 +0000
Subject: [PATCH 07/14] fix lesson factory to include nested project with same
 user_id

---
 spec/factories/lesson.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/factories/lesson.rb b/spec/factories/lesson.rb
index cc7da2fc0..180dba5c2 100644
--- a/spec/factories/lesson.rb
+++ b/spec/factories/lesson.rb
@@ -6,6 +6,6 @@
     sequence(:name) { |n| "Lesson #{n}" }
     description { 'Description' }
     visibility { 'teachers' }
-    project { create(:project) }
+    project { create(:project, user_id: user_id) }
   end
 end

From c65dd1d520a8ad5cff1f492844397410634269cf Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Tue, 3 Dec 2024 14:47:26 +0000
Subject: [PATCH 08/14] lesson factory rubocop

---
 spec/factories/lesson.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec/factories/lesson.rb b/spec/factories/lesson.rb
index 180dba5c2..d78ac5ed9 100644
--- a/spec/factories/lesson.rb
+++ b/spec/factories/lesson.rb
@@ -6,6 +6,6 @@
     sequence(:name) { |n| "Lesson #{n}" }
     description { 'Description' }
     visibility { 'teachers' }
-    project { create(:project, user_id: user_id) }
+    project { create(:project, user_id:) }
   end
 end

From 5721d906ae0dbea73b5c04e7aed3b39573a9d22f Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Tue, 3 Dec 2024 17:04:36 +0000
Subject: [PATCH 09/14] updating_a_lesson_spec - able to revert a couple of
 changes with factory updates

---
 spec/features/lesson/updating_a_lesson_spec.rb | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/spec/features/lesson/updating_a_lesson_spec.rb b/spec/features/lesson/updating_a_lesson_spec.rb
index cfc3c4165..47adab9a2 100644
--- a/spec/features/lesson/updating_a_lesson_spec.rb
+++ b/spec/features/lesson/updating_a_lesson_spec.rb
@@ -11,17 +11,14 @@
       }
     }
   end
-  let(:lesson) { build(:lesson, name: 'Test Lesson', user_id: owner.id) }
-  let(:owner) { create(:owner, school:, name: 'School Owner') }
+  let!(:lesson) { create(:lesson, name: 'Test Lesson', user_id: owner.id) }
   let(:teacher) { create(:teacher, school:) }
-  let(:school) { create(:school) }
-  let(:project) { create(:project) }
+  let(:school) { create(:verified_school) }
+  let(:owner) { create(:owner, school:, name: 'School Owner') }
 
   before do
     authenticated_in_hydra_as(owner)
     stub_user_info_api_for(teacher)
-    lesson
-    project.update!(lesson:, school:, user_id: lesson.user_id, identifier: 'something')
   end
 
   it 'responds 200 OK' do
@@ -61,8 +58,7 @@
   end
 
   context 'when the lesson is associated with a school (library)' do
-    let(:school) { create(:school) }
-    let(:lesson) { build(:lesson, school:, name: 'Test Lesson', visibility: 'teachers', user_id: teacher.id) }
+    let!(:lesson) { create(:lesson, school:, name: 'Test Lesson', visibility: 'teachers', user_id: teacher.id) }
 
     before do
       lesson

From 25f506eaf821b92a1658b88faddb0fa0ac417072 Mon Sep 17 00:00:00 2001
From: Lois Wells <lois.wells@raspberrypi.org>
Date: Wed, 4 Dec 2024 12:19:47 +0000
Subject: [PATCH 10/14] adding lesson update tests to check project and remixes
 are renamed

---
 spec/concepts/lesson/update_spec.rb | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/spec/concepts/lesson/update_spec.rb b/spec/concepts/lesson/update_spec.rb
index b46e56cd0..b6807f6c0 100644
--- a/spec/concepts/lesson/update_spec.rb
+++ b/spec/concepts/lesson/update_spec.rb
@@ -3,7 +3,11 @@
 require 'rails_helper'
 
 RSpec.describe Lesson::Update, type: :unit do
-  let(:lesson) { create(:lesson, name: 'Test Lesson') }
+  let(:school) { create(:school) }
+  let(:teacher) { create(:teacher, school:) }
+  let(:student) { create(:student, school:) }
+  let(:lesson) { create(:lesson, name: 'Test Lesson', user_id: teacher.id) }
+  let!(:student_project) { create(:project, remixed_from_id: lesson.project.id, user_id: student.id) }
 
   let(:lesson_params) do
     { name: 'New Name' }
@@ -19,6 +23,17 @@
     expect(response[:lesson].name).to eq('New Name')
   end
 
+  it 'updates the project name' do
+    described_class.call(lesson:, lesson_params:)
+    expect(lesson.project.name).to eq('New Name')
+  end
+
+  it 'updates the student project name' do
+    described_class.call(lesson:, lesson_params:)
+    student_remixes = lesson.project.remixes
+    expect(student_remixes.first.name).to eq('New Name')
+  end
+
   it 'returns the lesson in the operation response' do
     response = described_class.call(lesson:, lesson_params:)
     expect(response[:lesson]).to be_a(Lesson)

From a3314fbe0f07152d5000683fdaa8f0cad8022e8c Mon Sep 17 00:00:00 2001
From: Lois Wells <lois.wells@raspberrypi.org>
Date: Wed, 4 Dec 2024 12:34:46 +0000
Subject: [PATCH 11/14] fixing rubocop

---
 spec/concepts/lesson/update_spec.rb | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/spec/concepts/lesson/update_spec.rb b/spec/concepts/lesson/update_spec.rb
index b6807f6c0..fb1d6c5ee 100644
--- a/spec/concepts/lesson/update_spec.rb
+++ b/spec/concepts/lesson/update_spec.rb
@@ -30,8 +30,7 @@
 
   it 'updates the student project name' do
     described_class.call(lesson:, lesson_params:)
-    student_remixes = lesson.project.remixes
-    expect(student_remixes.first.name).to eq('New Name')
+    expect(student_project.reload.name).to eq('New Name')
   end
 
   it 'returns the lesson in the operation response' do

From 0e62b8c0b243661a0ee705a7331ac3df7e5eb6a5 Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Wed, 4 Dec 2024 16:54:28 +0000
Subject: [PATCH 12/14] lesson update project/remix save skips validations

---
 lib/concepts/lesson/operations/update.rb | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/concepts/lesson/operations/update.rb b/lib/concepts/lesson/operations/update.rb
index 8cdc3f4be..98b6eff66 100644
--- a/lib/concepts/lesson/operations/update.rb
+++ b/lib/concepts/lesson/operations/update.rb
@@ -21,13 +21,17 @@ def call(lesson:, lesson_params:)
       end
 
       def rename_lesson_project(lesson:, name:)
-        lesson.project.update!(name:)
+        return unless lesson.project
+
+        lesson.project.assign_attributes(name:)
+        lesson.project.save!(validate: false)
       end
 
       def rename_lesson_remixes(lesson:, name:)
         lesson_remixes = Project.where(remixed_from_id: lesson.project.id)
         lesson_remixes.each do |remix|
-          remix.update!(name:)
+          remix.assign_attributes(name:)
+          remix.save!(validate: false)
         end
       end
     end

From e0e4faf42dbbef26c5e01af84d4a9ecaeacf2b0f Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Thu, 5 Dec 2024 08:58:49 +0000
Subject: [PATCH 13/14] docs: add todo for validation false

---
 lib/concepts/lesson/operations/update.rb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/concepts/lesson/operations/update.rb b/lib/concepts/lesson/operations/update.rb
index 98b6eff66..e8e7b4abb 100644
--- a/lib/concepts/lesson/operations/update.rb
+++ b/lib/concepts/lesson/operations/update.rb
@@ -24,6 +24,7 @@ def rename_lesson_project(lesson:, name:)
         return unless lesson.project
 
         lesson.project.assign_attributes(name:)
+        # TODO: determine school owner mechanism for project model validation rather than skipping validation
         lesson.project.save!(validate: false)
       end
 
@@ -31,6 +32,7 @@ def rename_lesson_remixes(lesson:, name:)
         lesson_remixes = Project.where(remixed_from_id: lesson.project.id)
         lesson_remixes.each do |remix|
           remix.assign_attributes(name:)
+          # TODO: determine school owner mechanism for project model validation rather than skipping validation
           remix.save!(validate: false)
         end
       end

From c75c8a3e64001544cdd098a65a6f41afe631f9df Mon Sep 17 00:00:00 2001
From: Scott Adams <scott.adams@raspberrypi.org>
Date: Thu, 5 Dec 2024 09:40:24 +0000
Subject: [PATCH 14/14] trial either checking for owner role or if project has
 associations

---
 app/controllers/api/lessons_controller.rb |  2 +-
 app/models/project.rb                     | 11 +++++++++--
 lib/concepts/lesson/operations/update.rb  | 18 +++++++++---------
 spec/concepts/lesson/update_spec.rb       | 23 ++++++++++++++---------
 4 files changed, 33 insertions(+), 21 deletions(-)

diff --git a/app/controllers/api/lessons_controller.rb b/app/controllers/api/lessons_controller.rb
index 9fb7656c2..63408355e 100644
--- a/app/controllers/api/lessons_controller.rb
+++ b/app/controllers/api/lessons_controller.rb
@@ -42,7 +42,7 @@ def create_copy
     end
 
     def update
-      result = Lesson::Update.call(lesson: @lesson, lesson_params:)
+      result = Lesson::Update.call(lesson: @lesson, lesson_params:, current_user:)
 
       if result.success?
         @lesson_with_user = result[:lesson].with_user
diff --git a/app/models/project.rb b/app/models/project.rb
index f7e49a443..9d58ee413 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Project < ApplicationRecord
+  attr_accessor :current_user
+
   belongs_to :school, optional: true
   belongs_to :lesson, optional: true
   belongs_to :parent, optional: true, class_name: :Project, foreign_key: :remixed_from_id, inverse_of: :remixes
@@ -17,7 +19,7 @@ class Project < ApplicationRecord
   validate :identifier_cannot_be_taken_by_another_user
   validates :locale, presence: true, unless: :user_id
   validate :user_has_a_role_within_the_school
-  validate :user_is_a_member_or_the_owner_of_the_lesson
+  validate :user_is_a_member_or_the_owner_of_the_lesson_or_school
 
   scope :internal_projects, -> { where(user_id: nil) }
 
@@ -79,9 +81,14 @@ def user_has_a_role_within_the_school
     errors.add(:user, msg)
   end
 
-  def user_is_a_member_or_the_owner_of_the_lesson
+  def user_is_a_member_or_the_owner_of_the_lesson_or_school
     return if !lesson || user_id == lesson.user_id || lesson.school_class&.members&.exists?(student_id: user_id)
 
+    # either we explicitly check the user is an owner of the school
+    return if current_user&.school_owner?(lesson.school)
+    # or we bypass if the lesson is associated with a school but not a school class
+    return if lesson.school && !lesson.school_class && !lesson.school_class&.members&.any?
+
     errors.add(:user, "'#{user_id}' is not the owner or a member of the lesson '#{lesson_id}'")
   end
 end
diff --git a/lib/concepts/lesson/operations/update.rb b/lib/concepts/lesson/operations/update.rb
index e8e7b4abb..582780aa8 100644
--- a/lib/concepts/lesson/operations/update.rb
+++ b/lib/concepts/lesson/operations/update.rb
@@ -3,14 +3,14 @@
 class Lesson
   class Update
     class << self
-      def call(lesson:, lesson_params:)
+      def call(lesson:, lesson_params:, current_user:)
         response = OperationResponse.new
         response[:lesson] = lesson
         response[:lesson].assign_attributes(lesson_params)
         response[:lesson].save!
         if lesson_params[:name].present?
-          rename_lesson_project(lesson: response[:lesson], name: lesson_params[:name])
-          rename_lesson_remixes(lesson: response[:lesson], name: lesson_params[:name])
+          rename_lesson_project(current_user:, lesson: response[:lesson], name: lesson_params[:name])
+          rename_lesson_remixes(current_user:, lesson: response[:lesson], name: lesson_params[:name])
         end
         response
       rescue StandardError => e
@@ -20,20 +20,20 @@ def call(lesson:, lesson_params:)
         response
       end
 
-      def rename_lesson_project(lesson:, name:)
+      def rename_lesson_project(current_user:, lesson:, name:)
         return unless lesson.project
 
+        lesson.project.current_user = current_user
         lesson.project.assign_attributes(name:)
-        # TODO: determine school owner mechanism for project model validation rather than skipping validation
-        lesson.project.save!(validate: false)
+        lesson.project.save!
       end
 
-      def rename_lesson_remixes(lesson:, name:)
+      def rename_lesson_remixes(current_user:, lesson:, name:)
         lesson_remixes = Project.where(remixed_from_id: lesson.project.id)
         lesson_remixes.each do |remix|
+          remix.current_user = current_user
           remix.assign_attributes(name:)
-          # TODO: determine school owner mechanism for project model validation rather than skipping validation
-          remix.save!(validate: false)
+          remix.save!
         end
       end
     end
diff --git a/spec/concepts/lesson/update_spec.rb b/spec/concepts/lesson/update_spec.rb
index fb1d6c5ee..c3971502b 100644
--- a/spec/concepts/lesson/update_spec.rb
+++ b/spec/concepts/lesson/update_spec.rb
@@ -8,33 +8,38 @@
   let(:student) { create(:student, school:) }
   let(:lesson) { create(:lesson, name: 'Test Lesson', user_id: teacher.id) }
   let!(:student_project) { create(:project, remixed_from_id: lesson.project.id, user_id: student.id) }
+  let(:current_user) { authenticated_user }
 
   let(:lesson_params) do
     { name: 'New Name' }
   end
 
+  before do
+    authenticated_in_hydra_as(teacher)
+  end
+
   it 'returns a successful operation response' do
-    response = described_class.call(lesson:, lesson_params:)
+    response = described_class.call(lesson:, lesson_params:, current_user:)
     expect(response.success?).to be(true)
   end
 
   it 'updates the lesson' do
-    response = described_class.call(lesson:, lesson_params:)
+    response = described_class.call(lesson:, lesson_params:, current_user:)
     expect(response[:lesson].name).to eq('New Name')
   end
 
   it 'updates the project name' do
-    described_class.call(lesson:, lesson_params:)
+    described_class.call(lesson:, lesson_params:, current_user:)
     expect(lesson.project.name).to eq('New Name')
   end
 
   it 'updates the student project name' do
-    described_class.call(lesson:, lesson_params:)
+    described_class.call(lesson:, lesson_params:, current_user:)
     expect(student_project.reload.name).to eq('New Name')
   end
 
   it 'returns the lesson in the operation response' do
-    response = described_class.call(lesson:, lesson_params:)
+    response = described_class.call(lesson:, lesson_params:, current_user:)
     expect(response[:lesson]).to be_a(Lesson)
   end
 
@@ -46,22 +51,22 @@
     end
 
     it 'does not update the lesson' do
-      response = described_class.call(lesson:, lesson_params:)
+      response = described_class.call(lesson:, lesson_params:, current_user:)
       expect(response[:lesson].reload.name).to eq('Test Lesson')
     end
 
     it 'returns a failed operation response' do
-      response = described_class.call(lesson:, lesson_params:)
+      response = described_class.call(lesson:, lesson_params:, current_user:)
       expect(response.failure?).to be(true)
     end
 
     it 'returns the error message in the operation response' do
-      response = described_class.call(lesson:, lesson_params:)
+      response = described_class.call(lesson:, lesson_params:, current_user:)
       expect(response[:error]).to match(/Error updating lesson/)
     end
 
     it 'sent the exception to Sentry' do
-      described_class.call(lesson:, lesson_params:)
+      described_class.call(lesson:, lesson_params:, current_user:)
       expect(Sentry).to have_received(:capture_exception).with(kind_of(StandardError))
     end
   end