Defensive serving Scratch projects

app/controllers/api/scratch/projects_controller.rb

@@ -105,7 +105,10 @@ def move_pending_scratch_upload_to_remix(pending_upload, remix_project)
       end
 
       def load_project
-        @project = Project.find_by!(identifier: params.expect(:id), project_type: Project::Types::CODE_EDITOR_SCRATCH)
+        @project = Project.joins(:scratch_component).find_by!(
+          identifier: params.expect(:id),
+          project_type: Project::Types::CODE_EDITOR_SCRATCH
+        )
       end
     end
   end

spec/features/scratch/showing_a_scratch_project_spec.rb

@@ -73,6 +73,22 @@
     expect(response).to have_http_status(:not_found)
   end
 
+  it 'returns a 404 if project does not have a scratch component' do
+    authenticated_in_hydra_as(teacher)
+    project = create(
+      :project,
+      project_type: Project::Types::CODE_EDITOR_SCRATCH,
+      locale: 'en',
+      school: school,
+      user_id: teacher.id,
+      lesson: lesson
+    )
+
+    get "/api/scratch/projects/#{project.identifier}", headers: headers
+
+    expect(response).to have_http_status(:not_found)
+  end
+
   it 'returns a 200 ok if not logged in for an anonymous scratch project' do
     project = create(:scratch_project, locale: 'en', user_id: nil)
     get "/api/scratch/projects/#{project.identifier}"