fix hidden pages showing in mastery path progression

fixes OUT-1675

test plan:
- in a course with CYOE enabled, create a quiz
  - for ease of testing, ensure quiz is set up
    for retakes and using the latest score
- create some assignments and lock them to mastery paths
- create at least one wiki page, and also enable
  the 'mastery paths' checkbox on them (found under
  the textbox for editing content)
- add the assignments and page(s) to mastery paths on
  the quiz. Ensure the page(s) are on their own tiers
  for ease of testing
- create a module, add the quiz as the first item, the page(s)
  immediately following it, then the other assignments
- on the quiz, get a score that does NOT unlock the tier
  that the page(s) exist on
- the 'next' button for progressions should skip the still
  locked page (once paths finish processing or you make any
  necessary path selections, based on how you set things up)
- retake the quiz, and get a score that DOES unlock the page(s)
- the next page should appear as expected as the next item in
  the path progression one paths finish calculating
- teachers should not experience any changes in behavior,
  this should only impact students

Change-Id: Ibd2dd664723e1006944a1d9410ce3b442ae6ade7
Reviewed-on: https://gerrit.instructure.com/132873
Tested-by: Jenkins
Reviewed-by: Neil Gupta <ngupta@instructure.com>
QA-Review: Leo Abner <rabner@instructure.com>
Product-Review: Sidharth Oberoi <soberoi@instructure.com>

app/models/course.rb

@@ -325,8 +325,15 @@ class Course < ActiveRecord::Base
     end
 
     tags = DifferentiableAssignment.scope_filter(tags, user, self, is_teacher: user_is_teacher)
+    return tags if user.blank? || user_is_teacher
 
-    tags
+    path_visible_pages = self.wiki_pages.left_outer_joins(assignment: :submissions).
+      except(:preload).
+      where("assignments.id is null or submissions.user_id = ?", user.id).
+      select(:id)
+
+    tags.where("content_tags.content_type <> 'WikiPage' or
+      content_tags.content_id in (?)", path_visible_pages)
   end
 
   def sequential_module_item_ids

app/models/wiki_page.rb

@@ -47,6 +47,7 @@ class WikiPage < ActiveRecord::Base
   belongs_to :user
 
   belongs_to :context, polymorphic: [:course, :group]
+  belongs_to :assignment
 
   acts_as_url :title, :sync_url => true
 

spec/apis/v1/context_module_items_api_spec.rb

@@ -70,6 +70,38 @@ describe "Module Items API", type: :request do
       course_with_teacher(:course => @course, :active_all => true)
     end
 
+    it 'properly shows a wiki page item locked by CYOE from progressions' do
+          module_with_page = @course.context_modules.create!(name: "new module")
+          assignment = @course.assignments.create!(
+            name: "some assignment",
+            submission_types: ["online_text_entry"],
+            points_possible: 20
+          )
+          module_with_page.add_item(:id => assignment.id, :type => 'assignment')
+          page = @course.wiki_pages.create!(title: "some page")
+          page.assignment = @course.assignments.create!(
+            name: "hidden page",
+            submission_types: ["wiki_page"],
+            only_visible_to_overrides: true
+          )
+          page.save!
+          page_tag = module_with_page.add_item(:id => page.id, :type => 'wiki_page')
+          quiz = @course.quizzes.create!(:title => "some quiz")
+          quiz.publish!
+          module_with_page.add_item(:id => quiz.id, :type => 'quiz')
+          json = api_call(
+            :get, "/api/v1/courses/#{@course.id}/"\
+              "module_item_sequence?asset_type=Assignment&asset_id=#{assignment.id}",
+            :controller => "context_module_items_api",
+            :action => "item_sequence",
+            :format => "json",
+            :course_id => @course.to_param,
+            :asset_type => 'Assignment',
+            :asset_id => assignment.to_param
+          )
+          expect(json['items'][0]['next']['id']).to eq page_tag.id
+        end
+
     it "should list module items" do
       @assignment_tag.unpublish
       json = api_call(:get, "/api/v1/courses/#{@course.id}/modules/#{@module1.id}/items",
@@ -1201,6 +1233,38 @@ describe "Module Items API", type: :request do
           expect(mastery_paths).to be_truthy
         end
 
+        it 'properly omits a wiki page item locked by CYOE from progressions' do
+          module_with_page = @course.context_modules.create!(name: "new module")
+          assignment = @course.assignments.create!(
+            name: "some assignment",
+            submission_types: ["online_text_entry"],
+            points_possible: 20
+          )
+          module_with_page.add_item(:id => assignment.id, :type => 'assignment')
+          page = @course.wiki_pages.create!(title: "some page")
+          page.assignment = @course.assignments.create!(
+            name: "hidden page",
+            submission_types: ["wiki_page"],
+            only_visible_to_overrides: true
+          )
+          page.save!
+          module_with_page.add_item(:id => page.id, :type => 'wiki_page')
+          quiz = @course.quizzes.create!(:title => "some quiz")
+          quiz.publish!
+          quiz_tag = module_with_page.add_item(:id => quiz.id, :type => 'quiz')
+          json = api_call(
+            :get, "/api/v1/courses/#{@course.id}/"\
+              "module_item_sequence?asset_type=Assignment&asset_id=#{assignment.id}",
+            :controller => "context_module_items_api",
+            :action => "item_sequence",
+            :format => "json",
+            :course_id => @course.to_param,
+            :asset_type => 'Assignment',
+            :asset_id => assignment.to_param
+          )
+          expect(json['items'][0]['next']['id']).to eq quiz_tag.id
+        end
+
         it "includes model data merge from Canvas" do
           json = api_call(:get, "/api/v1/courses/#{@course.id}/modules/#{@cyoe_module2.id}/items?include[]=mastery_paths",
             :controller => "context_module_items_api", :action => "index", :format => "json",