Stop Hard concluded enrollments fromn participating in groups

fixes COMMS-1488

Test Plan
* Create a course and enroll at least 1 student
* Create a group set and a group to add the student to
* Manually conclude the students enrollment
* As the student navigate to your dashboard
* Notice you won't have access to the group

Change-Id: Ie5d6689e435af060352e02b2762d39351c5a131f
Reviewed-on: https://gerrit.instructure.com/168892
Tested-by: Jenkins
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
QA-Review: Landon Gilbert-Bland <lbland@instructure.com>
Product-Review: Aaron Hsu <ahsu@instructure.com>

app/models/group.rb

@@ -473,9 +473,17 @@ class Group < ActiveRecord::Base
   # if you modify this set_policy block, note that we've denormalized this
   # permission check for efficiency -- see User#cached_contexts
   set_policy do
+
     # Participate means the user is connected to the group somehow and can be
-    given { |user| user && can_participate?(user) }
-    can :participate
+    given { |user| user && can_participate?(user) && self.has_member?(user) }
+    can :participate and
+    can :manage_calendar and
+    can :manage_content and
+    can :manage_files and
+    can :manage_wiki and
+    can :post_to_forum and
+    can :create_collaborations and
+    can :create_forum
 
     # Course-level groups don't grant any permissions besides :participate (because for a teacher to add a student to a
     # group, the student must be able to :participate, and the teacher should be able to add students while the course
@@ -485,15 +493,8 @@ class Group < ActiveRecord::Base
 
     use_additional_policy do
       given { |user| user && self.has_member?(user) }
-      can :create_collaborations and
-      can :manage_calendar and
-      can :manage_content and
-      can :manage_files and
-      can :manage_wiki and
-      can :post_to_forum and
-      can :create_forum and
-      can :read and
       can :read_forum and
+      can :read and
       can :read_announcements and
       can :read_roster and
       can :view_unpublished_items

spec/apis/v1/discussion_topics_api_spec.rb

@@ -2976,7 +2976,7 @@ describe DiscussionTopicsController, type: :request do
     it "duplicate publishes group context discussions if its a student duplicating" do
       @user = @student
       group_category = @course.group_categories.create!(:name => 'group category')
-      @course.enroll_student(@student, :active_all => true)
+      @course.enroll_student(@student, :enrollment_state => "active")
       group = group_category.groups.create!(:name => "group", :context => @course)
       group.add_user(@student)
       topic = group.discussion_topics.create!(:title => "student topic", :user => @student,

spec/models/announcement_spec.rb

@@ -102,9 +102,16 @@ describe Announcement do
       expect(Announcement.context_allows_user_to_create?(@course, @user, {})).to be_falsey
     end
 
-    it "should allow announcements on a group" do
-      group_with_user(:active_user => 1)
-      expect(Announcement.context_allows_user_to_create?(@group, @user, {})).to be_truthy
+    it "should not allow announcements creation by students on a group" do
+      course_with_student
+      group_with_user(is_public: true, :active_user => 1, :context => @course)
+      expect(Announcement.context_allows_user_to_create?(@group, @student, {})).to be_falsey
+    end
+
+    it "should allow announcements creation by teacher on a group" do
+      course_with_teacher(:active_all => true)
+      group_with_user(is_public: true, :active_user => 1, :context => @course)
+      expect(Announcement.context_allows_user_to_create?(@group, @teacher, {})).to be_truthy
     end
 
     it 'allows announcements to be viewed without :read_forum' do