don't leak muted assignment scores on grade summary page

fixes CNVS-9633

regression from I2f989c0b0dba9a17c904ba516154adb18ceaaad5

Test plan:
  * mute an assignment in a course
  * load the students grade page as a student
  * grade the assignment for that student
  * refresh the student grades page
  * the assignment group totals should not have changed

Change-Id: I21651cf5be341224910dcca56f02154ef3ab77f4
Reviewed-on: https://gerrit.instructure.com/26666
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Amber Taniuchi <amber@instructure.com>
Product-Review: Cameron Matheson <cameron@instructure.com>

app/controllers/gradebooks_controller.rb

@@ -57,7 +57,10 @@ class GradebooksController < ApplicationController
           end
 
           submissions_json = @presenter.submissions.map { |s|
-            { assignment_id: s.assignment_id, score: s.score }
+            {
+              assignment_id: s.assignment_id,
+              score: s.grants_right?(@current_user, :read_grade)? s.score  : nil
+            }
           }
           ags_json = light_weight_ags_json(@presenter.groups)
           js_env submissions: submissions_json,

spec/controllers/gradebooks_controller_spec.rb

@@ -197,6 +197,23 @@ describe GradebooksController do
       assigns[:js_env][:assignment_groups].first[:assignments].first["discussion_topic"].should be_nil
     end
 
+    it "doesn't leak muted scores" do
+      course_with_student_logged_in
+      a1, a2 = 2.times.map { |i|
+        @course.assignments.create! name: "blah#{i}", points_possible: 10
+      }
+      a1.mute!
+      a1.grade_student(@student, grade: 10)
+      a2.grade_student(@student, grade: 5)
+      get 'grade_summary', course_id: @course.id, id: @student.id
+      assigns[:js_env][:submissions].sort_by { |s|
+        s[:assignment_id]
+      }.should == [
+        {score: nil, assignment_id: a1.id},
+        {score: 5, assignment_id: a2.id}
+      ]
+    end
+
     it "should sort assignments by due date (null last), then title" do
       course_with_teacher_logged_in(:active_all => true)
       student_in_course(:active_all => true)