Restrict students array output in JSON for specific scopes.

app/api/events_endpoints.rb

@@ -21,7 +21,11 @@ def represent(dataset)
         filtered = Interactors::Api::FilterEvents.perform(events: dataset, params: params, format: api_format)
         case api_format #XXX this is not great, it should be handled by Grape formatters
         when :jsonapi
-          Interactors::Api::RepresentEventsJson.perform(events: filtered.events, params: params).to_hash
+          Interactors::Api::RepresentEventsJson.perform(
+            events: filtered.events,
+            params: params,
+            student_output_permitted: current_user.student_access_allowed?
+          ).to_hash
         when :ical
           FormatEventsIcal.perform(events: filtered.events)
         else

app/interactors/api/represent_events_json.rb

@@ -10,12 +10,13 @@ class RepresentEventsJson
 
       attr_reader :meta, :events, :compounds, :representer
 
-      def perform(events:, params:)
+      def perform(events:, params:, student_output_permitted: true)
         paginated = Paginate.perform(dataset: events, params: params)
         @meta = paginated.meta
         @events = paginated.dataset
+
         @compounds = CompoundEvents.perform(events: @events, params: params).compounds
-        @representer = EventsRepresenter.for_collection.prepare(@events)
+        @representer = EventsRepresenter.for_collection.prepare(convert_events(@events, student_output_permitted))
       end
 
       def to_hash(options = {})
@@ -26,6 +27,15 @@ def to_hash(options = {})
           'meta' => meta)
       end
 
+      def convert_events(dataset, student_output_permitted)
+        if student_output_permitted
+          dataset
+        else
+          dataset.map do |evt|
+            evt.tap {|e| e.student_ids = [] }
+          end
+        end
+      end
     end
   end
 end