Limit student course sections to the one he is a member of

flag=react_discussions_post
closes VICE-2454

Test Plan:
 - Test pass
 - As a teacher create a discussion with
     limited sections and publish it.
 - Visit it as teacher, you should see all
     the sections available.
 - Visit it as student, you shouldn't see all
     the sections, only yours.

Change-Id: I1089b471eba20d4e2e55a3bfe6481a8c8bc53c10
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/290400
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Drake Harper <drake.harper@instructure.com>
Reviewed-by: Chawn Neal <chawn.neal@instructure.com>
Product-Review: Drake Harper <drake.harper@instructure.com>
QA-Review: Chawn Neal <chawn.neal@instructure.com>

app/graphql/types/discussion_type.rb

@@ -227,7 +227,28 @@ module Types
 
     field :course_sections, [Types::SectionType], null: false
     def course_sections
-      load_association(:course_sections)
+      course = nil
+      if object.context.is_a?(Course)
+        course = object.context
+      end
+
+      if object.context.is_a?(Group) && object.context.context.is_a?(Course)
+        course = object.context.context
+      end
+
+      load_association(:course_sections).then do |course_sections|
+        if course.nil?
+          course_sections
+        else
+          Loaders::CourseRoleLoader.for(course_id: course.id, role_types: nil, built_in_only: nil).load(current_user).then do |roles|
+            if roles&.include?("TeacherEnrollment") || roles&.include?("TaEnrollment") || roles&.include?("DesignerEnrollment")
+              course_sections
+            else
+              course_sections.joins(:student_enrollments).where(enrollments: { user_id: current_user.id })
+            end
+          end
+        end
+      end
     end
 
     field :can_unpublish, Boolean, null: false

spec/graphql/types/discussion_type_spec.rb

@@ -603,6 +603,21 @@ RSpec.shared_examples "DiscussionType" do
     expect(type.resolve("courseSections { name }")[0]).to eq section.name
   end
 
+  it "returns the appropriate course sections for students and teachers" do
+    section1 = add_section("Dope Section 1")
+    section2 = add_section("Dope Section 2")
+    student = student_in_course(active_all: true, section: section2)
+    topic = discussion_topic_model(context: @course, is_section_specific: true, course_section_ids: [section1.id, section2.id])
+
+    type_student = GraphQLTypeTester.new(topic, current_user: student.user)
+    expect(type_student.resolve("courseSections { _id }").length).to eq 1
+    expect(type_student.resolve("courseSections { _id }")[0]).to eq section2.id.to_s
+    expect(type_student.resolve("courseSections { name }")[0]).to eq section2.name
+
+    type_teacher = GraphQLTypeTester.new(topic, current_user: @teacher)
+    expect(type_teacher.resolve("courseSections { _id }").length).to eq 2
+  end
+
   it "returns if the discussion is able to be unpublished" do
     result = discussion_type.resolve("canUnpublish")
     expect(result).to eq discussion.can_unpublish?