Reject unassociated teacher accounts in Join Code flow

[mwtrew]

Also adds tests, updates the user factory to be aware of the new sub field, and updates some existing tests to take advantage of the factory.

Status

• Related to https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1595

What's changed?

• Uses the sub field from Hydra to prevent "full" (i.e. expected to be a teacher) accounts from erroneously going down the student add-to-class flow.

[Copilot]

Pull request overview

This PR updates the Join Code flow to distinguish “student account” identities from “full” (teacher-expected) identities using Hydra’s sub claim, preventing unassociated teacher accounts from being enrolled via the student join path.

Changes:

• Add User#student_account_type? (based on sub) and use it in JoinStatusService to return :not_a_student for non-student account types in the “new user” join path.
• Update factories and request/service specs to model student sub values and cover the new behavior.
• Extend User.from_token test coverage to assert sub is preserved for both full and student accounts.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
app/services/join_status_service.rb	Rejects join attempts from non-student account types when the user has no role in the school yet.
app/models/user.rb	Adds sub to user attributes and introduces student_account_type? used by join logic.
spec/factories/user.rb	Sets sub for users/students so tests can model Hydra subject formats.
spec/services/join_status_service_spec.rb	Updates/expands coverage to assert :not_a_student for non-student account types and cross-school non-student roles.
spec/requests/join_controller_spec.rb	Updates auth stubbing to provide student-style Hydra sub for join flow request specs.
spec/models/user_spec.rb	Adds assertions that from_token preserves sub and covers #student_account_type?.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Test coverage

93.43% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/32987920711