add submission inclusion for students in polling

fixes CNVS-13826
This commit embeds a student's own submission into the poll sessions
endpoints.

Test plan
1. As a teacher, create a poll with choices and an opened session.
2. As a student, submit a submission to the poll session.
3. As the student, request the poll sessions GET show endpoint.
- The student's submission should be available in the "poll_submissions"
  field.

Other considerations are privacy: a student shouldn't be able to see
others' submissions (unless the poll session has public results).

Change-Id: I6050d5597fd44c0c0e9672b8e69a38022a3ea22d
Reviewed-on: https://gerrit.instructure.com/37078
Reviewed-by: Derek DeVries <[email protected]>
Tested-by: Jenkins <[email protected]>
QA-Review: Caleb Guanzon <[email protected]>
Product-Review: Josh Simpson <[email protected]>

app/controllers/polling/poll_sessions_controller.rb

@@ -65,6 +65,10 @@ module Polling
   #         "description": "The results of the submissions of the poll. Each key is the poll choice id, and the value is the count of submissions.",
   #         "example": { "144": 10, "145": 3, "146": 27, "147": 8 },
   #         "type": "object"
+  #       },
+  #       "poll_submissions": {
+  #         "description": "If the poll session has public results, this will return an array of all submissions, viewable by both students and teachers. If the results are not public, for students it will return their submission only.",
+  #         "$ref": "PollSubmission"
   #       }
   #     }
   #   }

app/serializers/polling/poll_session_serializer.rb

@@ -7,17 +7,24 @@ class PollSessionSerializer < Canvas::APISerializer
 
     # has_many relationships with embedded objects doesn't work, so we override it this way
     def poll_submissions
-      @poll_submissions ||= object.poll_submissions.map do |submission|
-        Polling::PollSubmissionSerializer.new(submission, controller: @controller, scope: @scope, root: false)
-      end
+      @poll_submissions ||= begin
+                              if can_view_results?
+                                submissions = object.poll_submissions
+                              else
+                                submissions = object.poll_submissions.where(user_id: current_user)
+                              end
+                              submissions.map do |submission|
+                                Polling::PollSubmissionSerializer.new(submission, controller: @controller, scope: @scope, root: false)
+                              end
+                            end
     end
 
     def has_submitted
       object.has_submission_from?(current_user)
     end
 
     def filter(keys)
-      if poll.grants_right?(current_user, session, :update) || object.has_public_results?
+      if can_view_results?
         student_keys + teacher_keys
       else
         student_keys
@@ -26,12 +33,16 @@ def filter(keys)
 
     private
 
+    def can_view_results?
+      object.has_public_results? || poll.grants_right?(current_user, session, :update)
+    end
+
     def teacher_keys
-      [:has_public_results, :results, :poll_submissions]
+      [:has_public_results, :results]
     end
 
     def student_keys
-      [:id, :is_published, :course_id, :course_section_id, :created_at, :poll_id, :has_submitted]
+      [:id, :is_published, :course_id, :course_section_id, :created_at, :poll_id, :has_submitted, :poll_submissions]
     end
   end
 end

spec/apis/v1/polling/poll_sessions_api_spec.rb

@@ -185,12 +185,27 @@ def get_show(raw = false, data = {})
         2.times { create_submission(choice1) }
         1.times { create_submission(choice2) }
 
-        student = student_in_course(active_user:true).user
-        @user = student
+        @user = student_in_course(active_user:true).user
 
         json = get_show['poll_sessions'].first
 
-        json.should_not have_key('poll_submissions')
+        json.should have_key('poll_submissions')
+        json['poll_submissions'].size.should be_zero
+      end
+
+      it "does embed the student's own submission" do
+        choice = @poll.poll_choices.create!(text: 'Choice A', is_correct: true)
+        @user = student_in_course(active_user:true).user
+
+        @poll_session.poll_submissions.create!(
+          poll: @poll,
+          user: @user,
+          poll_choice: choice
+        )
+
+        json = get_show['poll_sessions'].first
+        json.should have_key('poll_submissions')
+        json['poll_submissions'].size.should be(1)
       end
 
       context "when has_public_results is false" do