Implement ProfileApiClient.list_school_students

Scott has confirmed that we're not currently expecting students created
in Profile API to be exposed by the UserInfo API. Instead we can
construct `User`s using the data returned from the students list
endpoint.

API docs: https://my.raspberrypi.org/api/v1/documentation/#/Students/post_schools__schoolId__students_list

Author: chrisroos

lib/concepts/school_student/list.rb

@@ -16,10 +16,10 @@ def call(school:, token:)
       private
 
       def list_students(school, token)
-        response = ProfileApiClient.list_school_students(token:, organisation_id: school.id)
-        user_ids = response.fetch(:ids)
-
-        User.from_userinfo(ids: user_ids)
+        student_ids = Role.student.where(school:).map(&:user_id)
+        ProfileApiClient.list_school_students(token:, school_id: school.id, student_ids:).map do |student|
+          User.new(student.to_h.slice(:id, :username, :name))
+        end
       end
     end
   end

lib/profile_api_client.rb

@@ -8,6 +8,7 @@ class ProfileApiClient
 
   School = Data.define(:id, :schoolCode, :updatedAt, :createdAt, :discardedAt)
   SafeguardingFlag = Data.define(:id, :userId, :flag, :email, :createdAt, :updatedAt, :discardedAt)
+  Student = Data.define(:id, :schoolId, :name, :username, :createdAt, :updatedAt, :discardedAt)
 
   class Error < StandardError; end
 
@@ -78,12 +79,16 @@ def remove_school_teacher(*)
       {}
     end
 
-    def list_school_students(token:, organisation_id:)
+    def list_school_students(token:, school_id:, student_ids:)
       return [] if token.blank?
 
-      _ = organisation_id
+      response = connection(token).post("/api/v1/schools/#{school_id}/students/list") do |request|
+        request.body = student_ids
+      end
 
-      {}
+      raise UnexpectedResponse, response unless response.status == 200
+
+      response.body.map { |attrs| Student.new(**attrs.symbolize_keys) }
     end
 
     def create_school_student(token:, username:, password:, name:, school_id:)

spec/concepts/school_student/list_spec.rb

@@ -8,7 +8,7 @@
   let(:student) { create(:student, school:) }
 
   before do
-    stub_profile_api_list_school_students(user_id: student.id)
+    stub_profile_api_list_school_students(school:, id: student.id, name: 'name', username: 'username')
     stub_user_info_api_for(student)
   end
 
@@ -21,12 +21,13 @@
     described_class.call(school:, token:)
 
     # TODO: Replace with WebMock assertion once the profile API has been built.
-    expect(ProfileApiClient).to have_received(:list_school_students).with(token:, organisation_id: school.id)
+    expect(ProfileApiClient).to have_received(:list_school_students).with(token:, school_id: school.id, student_ids: [student.id])
   end
 
   it 'returns the school students in the operation response' do
     response = described_class.call(school:, token:)
-    expect(response[:school_students].first).to be_a(User)
+    expected_user = User.new(id: student.id, name: 'name', username: 'username')
+    expect(response[:school_students].first).to eq(expected_user)
   end
 
   context 'when listing fails' do

spec/features/school_student/listing_school_students_spec.rb

@@ -5,14 +5,13 @@
 RSpec.describe 'Listing school students', type: :request do
   before do
     authenticated_in_hydra_as(owner)
-    stub_profile_api_list_school_students(user_id: student.id)
-    stub_user_info_api_for(student)
+    stub_profile_api_list_school_students(school:, id: student.id, name: 'School Student')
     stub_profile_api_create_safeguarding_flag
   end
 
   let(:headers) { { Authorization: UserProfileMock::TOKEN } }
   let(:school) { create(:school) }
-  let(:student) { create(:student, school:, name: 'School Student') }
+  let(:student) { create(:student, school:) }
   let(:owner) { create(:owner, school:) }
 
   it 'responds 200 OK' do

spec/lib/profile_api_client_spec.rb

@@ -419,4 +419,80 @@ def create_school_student
       described_class.create_school_student(token:, username:, password:, name:, school_id: school.id)
     end
   end
+
+  describe '.list_school_student' do
+    let(:school) { build(:school, id: SecureRandom.uuid) }
+    let(:list_students_url) { "#{api_url}/api/v1/schools/#{school.id}/students/list" }
+    let(:student_ids) { [SecureRandom.uuid] }
+
+    before do
+      stub_request(:post, list_students_url).to_return(status: 200, body: '[]', headers: { 'content-type' => 'application/json' })
+    end
+
+    it 'makes a request to the profile api host' do
+      list_school_students
+      expect(WebMock).to have_requested(:post, list_students_url)
+    end
+
+    it 'includes token in the authorization request header' do
+      list_school_students
+      expect(WebMock).to have_requested(:post, list_students_url).with(headers: { authorization: "Bearer #{token}" })
+    end
+
+    it 'includes the profile api key in the x-api-key request header' do
+      list_school_students
+      expect(WebMock).to have_requested(:post, list_students_url).with(headers: { 'x-api-key' => api_key })
+    end
+
+    it 'sets content-type of request to json' do
+      list_school_students
+      expect(WebMock).to have_requested(:post, list_students_url).with(headers: { 'content-type' => 'application/json' })
+    end
+
+    it 'sets accept header to json' do
+      list_school_students
+      expect(WebMock).to have_requested(:post, list_students_url).with(headers: { 'accept' => 'application/json' })
+    end
+
+    it 'sets body to the student IDs' do
+      list_school_students
+      expect(WebMock).to have_requested(:post, list_students_url).with(body: student_ids)
+    end
+
+    # rubocop:disable RSpec/ExampleLength
+    it 'returns the student(s) if successful' do
+      student = {
+        id: '549e4674-6ffd-4ac6-9a97-b4d7e5c0e5c5',
+        schoolId: '132383f1-702a-46a0-9eb2-a40dd4f212e3',
+        name: 'student-name',
+        username: 'student-username',
+        createdAt: '2024-07-03T13:00:40.041Z',
+        updatedAt: '2024-07-03T13:00:40.041Z',
+        discardedAt: nil
+      }
+      expected = ProfileApiClient::Student.new(**student)
+      stub_request(:post, list_students_url)
+        .to_return(status: 200, body: [student].to_json, headers: { 'content-type' => 'application/json' })
+      expect(list_school_students).to eq([expected])
+    end
+    # rubocop:enable RSpec/ExampleLength
+
+    it 'raises exception if anything other that 200 status code is returned' do
+      stub_request(:post, list_students_url)
+        .to_return(status: 201)
+
+      expect { list_school_students }.to raise_error(ProfileApiClient::UnexpectedResponse)
+    end
+
+    it 'raises faraday exception for 4xx and 5xx responses' do
+      stub_request(:post, list_students_url)
+        .to_return(status: 401)
+
+      expect { list_school_students }.to raise_error(Faraday::Error)
+    end
+
+    def list_school_students
+      described_class.list_school_students(token:, school_id: school.id, student_ids:)
+    end
+  end
 end

spec/support/profile_api_mock.rb

@@ -23,8 +23,14 @@ def stub_profile_api_remove_school_teacher
     allow(ProfileApiClient).to receive(:remove_school_teacher)
   end
 
-  def stub_profile_api_list_school_students(user_id:)
-    allow(ProfileApiClient).to receive(:list_school_students).and_return(ids: [user_id])
+  def stub_profile_api_list_school_students(school:, id:, username: '', name: '')
+    now = Time.current.to_fs(:iso8601) # rubocop:disable Naming/VariableNumber
+    student = ProfileApiClient::Student.new(
+      schoolId: school.id,
+      id:, username:, name:,
+      createdAt: now, updatedAt: now, discardedAt: nil
+    )
+    allow(ProfileApiClient).to receive(:list_school_students).and_return([student])
   end
 
   def stub_profile_api_create_school_student(user_id: SecureRandom.uuid)