add Attachments::ScopedToUser

fixes CNVS-21854

Moves permission-based scope concatenation from
FilesController#api_index to Attachments::ScopedToUser#scope. Updates
Folder permission policy to delegate permissions for :read_as_admin &
:manage_files to its context. Add Folder.from_context_or_id to
encapsulate folder finding logic from FilesController#api_index.

test plan:
- Regression testing for API files index action.

Change-Id: I1dc855cc16a98969482a72d251848c47e300b05c
Reviewed-on: https://gerrit.instructure.com/58415
Tested-by: Jenkins
Reviewed-by: Matt Berns <mberns@instructure.com>
QA-Review: Deepeeca Soundarrajan <dsoundarrajan@instructure.com>
Product-Review: John Corrigan <jcorrigan@instructure.com>

Author: John Corrigan

app/controllers/files_controller.rb

@@ -184,7 +184,14 @@ def index
               @current_attachments = @current_folder.visible_file_attachments.by_position_then_display_name
             end
             @current_attachments = @current_attachments.includes(:thumbnail, :media_object)
-            render :json => @current_attachments.map{ |a| a.as_json(methods: [:readable_size, :currently_locked, :thumbnail_url], permissions: {user: @current_user, session: session}) }
+            render :json => @current_attachments.map do |a|
+              a.as_json({
+                methods: [ :readable_size, :currently_locked, :thumbnail_url ],
+                permissions: {
+                  user: @current_user, session: session
+                }
+              })
+            end
           else
             file_structure = {
               :contexts => [@context.as_json(permissions: {user: @current_user})],
@@ -249,38 +256,17 @@ def index
   # @returns [File]
   def api_index
     get_context
-    if @context
-      folder = Folder.root_folders(@context).first
-      raise ActiveRecord::RecordNotFound unless folder
-      context_index = true
-    else
-      verify_api_id
-      folder = Folder.find(params[:id])
-    end
+    verify_api_id unless @context.present?
+    @folder = Folder.from_context_or_id(@context, params[:id])
 
-    if authorized_action(folder, @current_user, :read_contents)
-      @context = folder.context unless context_index
-      can_view_hidden_files = can_view_hidden_files?(@context, @current_user, session)
+    if authorized_action(@folder, @current_user, :read_contents)
       params[:sort] ||= params[:sort_by] # :sort_by was undocumented; :sort is more consistent with other APIs such as wikis
       params[:include] = Array(params[:include])
       params[:include] << 'user' if params[:sort] == 'user'
 
-      if context_index
-        if can_view_hidden_files
-          scope = @context.attachments.not_deleted
-        else
-          scope = @context.attachments.visible.not_hidden.not_locked.where(
-              :folder_id => Folder.all_visible_folder_ids(@context))
-        end
-      else
-        if can_view_hidden_files
-          scope = folder.active_file_attachments
-        else
-          scope = folder.visible_file_attachments.not_hidden.not_locked
-        end
-      end
-      scope = scope.includes(:user) if params[:include].include? 'user' && params[:sort] != 'user'
-      scope = scope.includes(:usage_rights) if params[:include].include? 'usage_rights'
+      scope = Attachments::ScopedToUser.new(@context || @folder, @current_user).scope
+      scope = scope.includes(:user) if params[:include].include?('user') && params[:sort] != 'user'
+      scope = scope.includes(:usage_rights) if params[:include].include?('usage_rights')
       scope = Attachment.search_by_attribute(scope, :display_name, params[:search_term])
 
       order_clause = case params[:sort]
@@ -307,12 +293,14 @@ def api_index
         scope = scope.by_content_types(Array(params[:content_types]))
       end
 
-      url = context_index ? context_files_url : api_v1_list_files_url(folder)
+      url = @context ? context_files_url : api_v1_list_files_url(@folder)
       @files = Api.paginate(scope, self, url)
-      render :json => attachments_json(@files, @current_user, {},
-          :can_view_hidden_files => can_view_hidden_files, :include => params[:include],
-          :only => params[:only],
-          :omit_verifier_in_app => !value_to_boolean(params[:use_verifiers]))
+      render json: attachments_json(@files, @current_user, {}, {
+        can_view_hidden_files: can_view_hidden_files?(@context || @folder, @current_user, session),
+        include: params[:include],
+        only: params[:only],
+        omit_verifier_in_app: !value_to_boolean(params[:use_verifiers])
+      })
     end
   end
 
@@ -1104,7 +1092,6 @@ def show_thumbnail
   end
 
   private
-
   def render_attachment_json(attachment, deleted_attachments, folder = attachment.folder)
     json = {
       :attachment => attachment.as_json(
@@ -1121,5 +1108,4 @@ def render_attachment_json(attachment, deleted_attachments, folder = attachment.
 
     render :json => json, :as_text => true
   end
-
 end

app/models/attachments/scoped_to_user.rb

@@ -0,0 +1,46 @@
+#
+# Copyright (C) 2011 - 2015 Instructure, Inc.
+#
+# This file is part of Canvas.
+#
+# Canvas is free software: you can redistribute it and/or modify it under
+# the terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, version 3 of the License.
+#
+# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along
+# with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+
+module Attachments
+  class ScopedToUser < ScopeFilter
+    include Api::V1::Attachment
+
+    def scope
+      context.is_a_context? ? scope_from_context : scope_from_folder
+    end
+
+    private
+    def scope_from_context
+      if can_view_hidden_files?(context, user)
+        context.attachments.not_deleted
+      else
+        context.attachments.visible.not_hidden.not_locked.where({
+          folder_id: Folder.all_visible_folder_ids(context)
+        })
+      end
+    end
+
+    def scope_from_folder
+      if can_view_hidden_files?(context, user)
+        context.active_file_attachments
+      else
+        context.visible_file_attachments.not_hidden.not_locked
+      end
+    end
+  end
+end

app/models/folder.rb

@@ -464,6 +464,12 @@ def currently_locked
 
     given {|user, session| self.protected? && !self.locked? && self.context.grants_right?(user, session, :read) && self.context.users.include?(user) }
     can :read and can :read_contents
+
+    given { |user, session| self.context.grants_right?(user, session, :manage_files) }
+    can :manage_files
+
+    given { |user, session| self.context.grants_right?(user, session, :read_as_admin) }
+    can :read_as_admin
   end
 
   # find all unlocked/visible folders that can be reached by following unlocked/visible folders from the root
@@ -479,7 +485,9 @@ def self.all_visible_folder_ids(context)
     visible_ids
   end
 
-  private
+  def self.from_context_or_id(context, id)
+    root_folders(context).first || where(id: id).first || (raise ActiveRecord::RecordNotFound)
+  end
 
   def self.find_visible_folders(visible_ids, folder_tree, dir_contents)
     visible_ids.concat dir_contents
@@ -489,4 +497,5 @@ def self.find_visible_folders(visible_ids, folder_tree, dir_contents)
     end
     nil
   end
+  private_class_method :find_visible_folders
 end

spec/models/folder_spec.rb

@@ -307,4 +307,27 @@
       end
     end
   end
+
+  describe ".from_context_or_id" do
+    it "delegate to root_folders when context is provided" do
+      folder = Folder.root_folders(@course).first
+      expect(Folder.from_context_or_id(@course, nil)).to eq(folder)
+    end
+
+    it "should find by id when context is not provided and id is" do
+      Folder.root_folders(@course).first
+      account_model
+      folder_model(context: @account)
+      expect(Folder.root_folders(@course).first).not_to eq(@folder),
+        'precondition'
+      expect(Folder.from_context_or_id(nil, @folder.id)).to eq(@folder)
+    end
+
+    it "should raise ActiveRecord::RecordNotFound when no record is found" do
+      expect(Folder.where(id: 1)).to be_empty, 'precondition'
+      expect {
+        Folder.from_context_or_id(nil, 1)
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
 end