Returns in-progress quiz submissions on api index

When a student has an in progress submission, only that submission is
returned from the quiz_submissions#index API endpoint.  When there isn't
an in-progress quiz_submission, all completed submissions (including
previous attempts) are returned.

Closes CNVS-21848

Test Plan:
  - Start a quiz
  - Confirm that student can get their quiz_submission in the
    quiz_submissions#index API result.
  - Complete the submission.
  - Confirm that the completed version is returned at the API endpoint.
  - Take it again.
  - Confirm step 2, 3, and that both completed versions are returned
    afterwards.

Change-Id: I25cbcc31f11c233431cbd4b77bfa18fc75aad8be
Reviewed-on: https://gerrit.instructure.com/58328
Tested-by: Jenkins
QA-Review: Michael Hargiss <mhargiss@instructure.com>
Reviewed-by: Brian Finney <bfinney@instructure.com>
Product-Review: Ryan Taylor <rtaylor@instructure.com>

app/controllers/quizzes/quiz_submissions_api_controller.rb

@@ -171,8 +171,13 @@ class Quizzes::QuizSubmissionsApiController < ApplicationController
         self,
         api_v1_course_quiz_submissions_url(@context, @quiz)
     elsif @quiz.grants_right?(@current_user, session, :submit)
-      # students have access only to their own
-      @quiz.quiz_submissions.where(:user_id => @current_user).flat_map(&:submitted_attempts)
+      # students have access only to their own submissions, both in progress, or completed`
+      submission = @quiz.quiz_submissions.where(:user_id => @current_user).first
+      if submission.workflow_state == "untaken"
+        [submission]
+      else
+        submission.submitted_attempts
+      end
     end
 
     if !quiz_submissions

spec/apis/v1/quizzes/quiz_submissions_api_spec.rb

@@ -31,7 +31,7 @@ shared_examples_for 'Quiz Submissions API Restricted Endpoints' do
 
     subject.stubs(:ldb_plugin).returns fake_plugin
     Canvas::LockdownBrowser.stubs(:plugin).returns fake_plugin
-    
+
     @request_proxy.call true, {
       attempt: 1
     }
@@ -207,6 +207,18 @@ describe Quizzes::QuizSubmissionsApiController, type: :request do
       expect(json['quiz_submissions'].length).to eq 2
     end
 
+    it 'should show in progress attempt only when applicable' do
+      enroll_student
+      @quiz_submission = @quiz.generate_submission(@student)
+      json = qs_api_index
+
+      expect(json.key?('quiz_submissions')).to be_truthy
+      expect(json['quiz_submissions'].length).to eq 1
+      expect(json['quiz_submissions'].first['started_at']).to be_truthy
+      expect(json['quiz_submissions'].first['workflow_state']).to eq 'untaken'
+      expect(json['quiz_submissions'].first['finished_at']).to eq nil
+    end
+
     it 'should show most recent attemps of quiz to teacher' do
       enroll_student_and_submit
       make_second_attempt