don't show media preview thumbnails to students for locked files

test plan:
* with kaltura/notorious enabled, add a link to a media file
 (video/audio) in rich content (e.g. a wiki page)
* should show a preview thumbnail generate a preview
* lock the file
* view the page as a student
* should not show a preview thumbnail

closes #CNVS-6965

Change-Id: I3743ac7b2e54d6a3c57e9ea3338b25cce75825bb
Reviewed-on: https://gerrit.instructure.com/50927
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>

app/coffeescripts/jquery/mediaCommentThumbnail.coffee

@@ -3,7 +3,8 @@ define [
   'underscore'
   'str/htmlEscape'
   'jquery'
-], (I18n, _, htmlEscape, $) ->
+  'compiled/util/deparam'
+], (I18n, _, htmlEscape, $, deparam) ->
 
   MEDIA_COMMENT_THUMBNAIL_SIZES =
     normal: {width: 140, height: 100}
@@ -13,6 +14,10 @@ define [
     return console.log('Kaltura has not been enabled for this account') unless INST.kalturaSettings
 
     $link = $(elem)
+    try
+      url = new URL($link.attr('href'))
+    return if url && deparam(url.search).no_preview
+
     dimensions = MEDIA_COMMENT_THUMBNAIL_SIZES[size] ? MEDIA_COMMENT_THUMBNAIL_SIZES.normal
     id = $link.data('media_comment_id') ||
          $.trim($link.find(".media_comment_id:first").text()) ||

app/coffeescripts/util/deparam.coffee

@@ -11,12 +11,13 @@ define ['compiled/object/unflatten'], (unflatten) ->
   deparam = (params, coerce) ->
     # shortcut for just deparam'ing the current querystring
     if !params or typeof params == 'boolean'
-      currentQueryString = window.location.search.replace(/^\?/, '')
+      currentQueryString = window.location.search
       return {} unless currentQueryString
       return deparam currentQueryString, arguments...
 
     obj = {}
 
+    params = params.replace(/^\?/, '')
     # Iterate over all name=value pairs.
     for param in params.replace(/\+/g, " ").split("&")
       [key, val] = param.split '='

app/controllers/media_objects_controller.rb

@@ -87,6 +87,7 @@ class MediaObjectsController < ApplicationController
         :singleton => "retrieve_media_details:#{media_object.media_id}"
       })
     end
+
     media_object.viewed!
     render :json => media_object_api_json(media_object, @current_user, session)
   end

app/models/attachment.rb

@@ -282,8 +282,7 @@ class Attachment < ActiveRecord::Base
     return true if self.class.skip_media_object_creation?
     in_the_right_state = self.file_state == 'available' && self.workflow_state !~ /^unattached/
     transitioned_to_this_state = self.id_was == nil || self.file_state_changed? && self.workflow_state_was =~ /^unattached/
-    if in_the_right_state && transitioned_to_this_state &&
-        self.content_type && self.content_type.match(/\A(video|audio)/)
+    if in_the_right_state && transitioned_to_this_state && self.previewable_media?
       delay = Setting.get('attachment_build_media_object_delay_seconds', 10.to_s).to_i
       MediaObject.send_later_enqueue_args(:add_media_files, { :run_at => delay.seconds.from_now, :priority => Delayed::LOWER_PRIORITY }, self, false)
     end
@@ -392,7 +391,7 @@ class Attachment < ActiveRecord::Base
       self.namespace = infer_namespace
     end
 
-    self.media_entry_id ||= 'maybe' if self.new_record? && self.content_type && self.content_type.match(/(video|audio)/)
+    self.media_entry_id ||= 'maybe' if self.new_record? && self.previewable_media?
   end
   protected :default_values
 
@@ -1458,6 +1457,10 @@ class Attachment < ActiveRecord::Base
     "/api/v1/crocodoc_session?#{preview_params(user, "crocodoc")}"
   end
 
+  def previewable_media?
+    self.content_type && self.content_type.match(/\A(video|audio)/)
+  end
+
   def preview_params(user, type)
     blob = {
       user_id: user.try(:global_id),

lib/api.rb

@@ -412,7 +412,14 @@ module Api
                 end
       end
 
-      next unless obj && ((is_public && !obj.locked_for?(user)) || obj.grants_right?(user, nil, :download))
+      unless obj && ((is_public && !obj.locked_for?(user)) || obj.grants_right?(user, nil, :download))
+        if obj && obj.previewable_media? && (uri = URI.parse(match.url) rescue nil)
+          uri.query = (uri.query.to_s.split("&") + ["no_preview=1"]).join("&")
+          next uri.to_s
+        else
+          next
+        end
+      end
 
       if ["Course", "Group", "Account", "User"].include?(obj.context_type)
         opts = {:only_path => true}

spec/selenium/enhanceable_content_spec.rb

@@ -116,8 +116,51 @@ describe "enhanceable_content" do
     expect(headers[1]).to have_class('ui-state-default')
     expect(divs[0]).to be_displayed
     expect(divs[1]).not_to be_displayed
-
+    
     expect(f('#media_comment_0_deadbeef span.media_comment_thumbnail')).not_to be_nil
   end
+
+  context "media file preview thumbnails" do
+    before :each do
+      stub_kaltura
+      course(:active_all => true)
+
+      @attachment = @course.attachments.create!(:uploaded_data => stub_file_data('video1.mp4', nil, 'video/mp4'))
+      @page = @course.wiki.wiki_pages.build(:title => 'title')
+      @page.body = %{
+        <a id="media_comment_0_deadbeef" class="instructure_file_link instructure_video_link" title="Video.mp4"
+          href="/courses/#{@course.id}/files/#{@attachment.id}/download?wrap=1">Video</a>
+      }
+      @page.save!
+    end
+
+    it "should show for students" do
+      student_in_course(:course => @course, :active_user => true)
+      user_session(@student)
+      get "/courses/#{@course.id}/wiki/#{@page.url}"
+      expect(f('#media_comment_0_deadbeef span.media_comment_thumbnail')).to_not be_nil
+    end
+
+    describe "for locked files" do
+      before :each do
+        @attachment.locked = true
+        @attachment.save!
+      end
+
+      it "should not show for students" do
+        student_in_course(:course => @course, :active_user => true)
+        user_session(@student)
+        get "/courses/#{@course.id}/wiki/#{@page.url}"
+        expect(f('#media_comment_0_deadbeef span.media_comment_thumbnail')).to be_nil
+      end
+
+      it "should show for teachers" do
+        teacher_in_course(:course => @course, :active_user => true)
+        user_session(@teacher)
+        get "/courses/#{@course.id}/wiki/#{@page.url}"
+        expect(f('#media_comment_0_deadbeef span.media_comment_thumbnail')).to_not be_nil
+      end
+    end
+  end
 end