don't add verifiers for unpublished files in public syllabus

test plan:
* create a public published course
* add a link to an unpublished file on the syllabus
* should not be accessible publicly

closes #CNVS-18404

Change-Id: I5767cd31e614ec36f1820beef8b688e98bbca4f2
Reviewed-on: https://gerrit.instructure.com/48376
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jahnavi Yetukuri <jyetukuri@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>

lib/api.rb

@@ -412,7 +412,7 @@ module Api
                 end
       end
 
-      next unless obj && (is_public || obj.grants_right?(user, nil, :download))
+      next unless obj && ((is_public && !obj.locked_for?(user)) || obj.grants_right?(user, nil, :download))
 
       if ["Course", "Group", "Account", "User"].include?(obj.context_type)
         opts = {:verifier => obj.uuid, :only_path => true}

spec/integration/syllabus_spec.rb

@@ -40,7 +40,7 @@ describe "syllabus" do
     anonymous_syllabus_access_allowed :public_syllabus
   end
 
-  it "should allow viewing files in a public syllabus" do
+  it "should allow viewing available files in a public syllabus" do
     course(:active_all => true)
     attachment_model
     @course.syllabus_body = "<a href=\"/courses/#{@course.id}/files/#{@attachment.id}/download\">linky</a>"
@@ -56,6 +56,25 @@ describe "syllabus" do
     expect(link.attributes['href'].value).to include("verifier=#{@attachment.uuid}")
   end
 
+  it "should not allow viewing locked files in a public syllabus" do
+    course(:active_all => true)
+    attachment_model
+    @attachment.locked = true
+    @attachment.save!
+
+    @course.syllabus_body = "<a href=\"/courses/#{@course.id}/files/#{@attachment.id}/download\">linky</a>"
+    @course.public_syllabus = true
+    @course.save!
+
+    get "/courses/#{@course.id}/assignments/syllabus"
+
+    expect(response).to be_success
+    page = Nokogiri::HTML(response.body)
+    expect(page.css('#identity a[href="/login"]')).not_to be_nil
+    link = page.at_css('#course_syllabus a')
+    expect(link.attributes['href'].value).to_not include("verifier=#{@attachment.uuid}")
+  end
+
   it "should display syllabus description on syllabus course home pages" do
     course_with_teacher_logged_in(:active_all => true)
     syllabus_body = "test syllabus body"