Only experience-cs admins can destroy public projects

For the moment, we only want to allow experience-cs admin users to be
able to destroy public projects.

Author: floehopper

app/controllers/api/public_projects_controller.rb

@@ -32,6 +32,8 @@ def update
     end
 
     def destroy
+      authorize! :update, :public_project
+
       if @project.destroy
         head :ok
       else

spec/features/public_project/destroying_a_public_project_spec.rb

@@ -3,7 +3,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Destroying a public project', type: :request do
-  let(:destroyer) { build(:user) }
+  let(:destroyer) { build(:experience_cs_admin_user) }
   let(:project) { create(:project, locale: 'en') }
   let(:headers) { { Authorization: UserProfileMock::TOKEN } }
 
@@ -26,6 +26,15 @@
     expect(response).to have_http_status(:unauthorized)
   end
 
+  context 'when destroyer is not an experience-cs admin' do
+    let(:destroyer) { build(:user) }
+
+    it 'responds 403 Forbidden' do
+      delete("/api/public_projects/#{project.identifier}", headers:)
+      expect(response).to have_http_status(:forbidden)
+    end
+  end
+
   it 'responds 404 Not Found when project is not found' do
     delete('/api/public_projects/another-identifier', headers:)
     expect(response).to have_http_status(:not_found)

spec/requests/public_projects/destroy_spec.rb

@@ -6,7 +6,7 @@
   let(:locale) { 'fr' }
   let(:project_loader) { instance_double(ProjectLoader) }
   let(:project) { create(:project, locale: 'en') }
-  let(:destroyer) { build(:user) }
+  let(:destroyer) { build(:experience_cs_admin_user) }
 
   context 'when auth is correct' do
     let(:headers) { { Authorization: UserProfileMock::TOKEN } }