don't show groups to students for unpublished courses

try to future proof it as well by tying to :read permission

test plan:
* add a student a group in an unpublished course
* it should not be shown on the dashboard list of groups

closes #CNVS-30391

Change-Id: I84ddeb9a096ad80aec89805b044e03a2c2670ea3
Reviewed-on: https://gerrit.instructure.com/86823
Tested-by: Jenkins
Reviewed-by: Clay Diffrient <cdiffrient@instructure.com>
QA-Review: Heath Hales <hhales@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>

app/jsx/navigation_header/Navigation.jsx

@@ -20,7 +20,7 @@ define([
 
   var TYPE_URL_MAP = {
     courses: '/api/v1/users/self/favorites/courses?include=term',
-    groups: '/api/v1/users/self/groups',
+    groups: '/api/v1/users/self/groups?include[]=can_access',
     accounts: '/api/v1/accounts'
   };
 

app/jsx/navigation_header/trays/GroupsTray.jsx

@@ -26,7 +26,7 @@ define([
         );
       }
       var groups =  this.props.groups.map((group) => {
-        if (!group.concluded) {
+        if (group.can_access && !group.concluded) {
           return <li className="ReactTray-list-item" key={group.id}><a href={`/groups/${group.id}`}>{group.name}</a></li>;
         };
       });

lib/api/v1/group.rb

@@ -63,6 +63,10 @@ module Api::V1::Group
     hash['has_submission'] = group.submission?
     hash['concluded'] = group.context.concluded? || group.context.deleted?
     hash['tabs'] = tabs_available_json(group, user, session, ['external']) if includes.include?('tabs')
+
+    if includes.include?('can_access')
+      hash['can_access'] = group.grants_right?(@current_user, :read)
+    end
     hash
   end
 

spec/selenium/dashboard_spec.rb

@@ -250,13 +250,19 @@ describe "dashboard" do
         group = Group.create!(:name => "group1", :context => @course)
         group.add_user(@user)
 
+        other_unpublished_course = course
+        other_group = Group.create!(:name => "group2", :context => other_unpublished_course)
+        other_group.add_user(@user)
+
         get "/"
 
         if ENV['CANVAS_FORCE_USE_NEW_STYLES']
           f('#global_nav_groups_link').click
           expect(fj(".ReactTray__headline:contains('Groups')")).to be_displayed
           wait_for_ajax_requests
-          expect(fj(".ReactTray-list-item a:contains('#{group.name}')")).to be_displayed
+          list = fj(".ReactTray__link-list")
+          expect(list).to include_text(group.name)
+          expect(list).to_not include_text(other_group.name)
         else
           driver.execute_script %{$('#courses_menu_item').addClass('hover');}
           expect(f('#courses_menu_item')).to include_text(group.name)