Add studio (view/modify) API

[towerofnix]

See LLK/scratch-www#1985. This is probably a big one!

• [x] (GET) /projects/<id>/studios
• [x] (GET) /users/<username>/studios/curate
• [ ] (POST) /studios/<id>/project/<id> (add to studio; requires auth)
• [ ] (DELETE) /studios/<id>/project/<id> (remove from studio; requires auth)

[joker314]

By the way, it's not <id> for some of these, but instead <username>.

My theory was that endpoints that are sent an authentication token will return extra data for the Scratch Team. I find this not as likely anymore, though -- so it might be that the implementation in the linked issue is wrong. (Or a bug in the API!). Either way, devs might want to know.

[towerofnix]

My guess is that you need authentication to join a studio, but not to view your (or anyone's) studio list. So either the PR writer (@benjiwheeler, pinging you) or internal documentation for scratch-api made a mistake and thought authentication was needed either way.

Anyways, it makes sense that you can view a list of which studios a user is curating without being authenticated; that's one of the rows on any profile page ("Studios I Curate").

[joker314]

There exists a risk that ST employees are instructed not to interact with repositories of others (especially of kids), it might be a good idea to track this in the pull request rather than here -- especially since all the ST devs will be watching?

[towerofnix]

Oh, good point. I just didn't want to look like I was intruding on the discussion of a PR I'm unrelated to.

[towerofnix]

@joker314 Update - see https://github.com/LLK/scratch-www/pull/1985/commits/a60da11f8ae2069dd36e4d42e0001cbd93af78b7 - indeed, that was just a mistake in the PR code. Getting the curated studios list doesn't require auth.

[towerofnix]

Latter two endpoints won't work until preview page is out. Test code:

async function go() {
  const projectID = 248475643
  const studioID = 5542140

  const token = await fetch('/session', {headers: {'X-Requested-With': 'XMLHttpRequest'}}).then(res => res.json()).then(data => data.user.token)

  const res = await fetch(`https://api.scratch.mit.edu/studios/${studioID}/${projectID}?x-token=${token}`, {method: 'POST'})

  console.log(res)
}
go().catch(err => console.error(err))