MDL-72925 mod_forum: Filter discussion when grading

mod/forum/externallib.php

@@ -2003,6 +2003,9 @@ public static function get_discussion_posts_by_userid(int $userid, int $cmid, ?s
         $builtdiscussions = [];
         foreach ($discussionsummaries as $discussionsummary) {
             $discussion = $discussionsummary->get_discussion();
+            if (!$capabilitymanager->can_view_discussion($USER, $discussion)) {
+                continue;
+            }
             $posts = $postvault->get_posts_in_discussion_for_user_id(
                     $discussion->get_id(),
                     $user->id,

mod/forum/tests/behat/separate_group_grade_forum.feature

@@ -72,3 +72,37 @@ Feature: I can grade a students by group with separate groups
     Then I should not see "1 out of 1"
     And I should not see "1 out of 2"
     And I should see "1 out of 3"
+
+  @javascript
+  Scenario: Teacher can see only the discussions which are joined to
+    Given the following "users" exist:
+      | username | firstname | lastname | email |
+      | teacher2 | Teacher | 2 | teacher2@example.com |
+    And the following "course enrolments" exist:
+      | user | course | role |
+      | teacher2 | C1 | teacher |
+    And the following "group members" exist:
+      | user | group |
+      | teacher2 | G2 |
+      | teacher2 | G3 |
+    And I log out
+    When I am on the "Test Forum 1" "forum activity" page logged in as student1
+    And I select "Group A" from the "Separate groups" singleselect
+    And I click on "Add a new discussion topic" "link"
+    And I set the following fields to these values:
+      | Subject  | Discussion subject A |
+      | Message | Discussion message A |
+    And I press "Post to forum"
+    And I select "Group C" from the "Separate groups" singleselect
+    And I click on "Add a new discussion topic" "link"
+    And I set the following fields to these values:
+      | Subject  | Discussion subject C |
+      | Message | Discussion message C |
+    And I press "Post to forum"
+    And I log out
+    Then I am on the "Test Forum 1" "forum activity" page logged in as teacher2
+    And I select "Group C" from the "Separate groups" singleselect
+    And I click on "Grade users" "button"
+    And I should see "Student 1"
+    And I should see "Discussion subject C"
+    And I should not see "Discussion subject A"

mod/forum/tests/externallib_test.php

@@ -2913,6 +2913,32 @@ public function test_mod_forum_get_discussion_posts_by_userid() {
         $this->assertEquals(2, count($discussions['discussions']));
 
         $this->assertEquals($expectedposts, $discussions);
+
+        // When groupmode is SEPARATEGROUPS, even there is no groupid specified, the post not for the user shouldn't be seen.
+        $group1 = self::getDataGenerator()->create_group(['courseid' => $course1->id]);
+        $group2 = self::getDataGenerator()->create_group(['courseid' => $course1->id]);
+        // Update discussion with group.
+        $discussion = new \stdClass();
+        $discussion->id = $discussion1->id;
+        $discussion->groupid = $group1->id;
+        $DB->update_record('forum_discussions', $discussion);
+        $discussion = new \stdClass();
+        $discussion->id = $discussion2->id;
+        $discussion->groupid = $group2->id;
+        $DB->update_record('forum_discussions', $discussion);
+        $cm = get_coursemodule_from_id('forum', $forum1->cmid);
+        $cm->groupmode = SEPARATEGROUPS;
+        $DB->update_record('course_modules', $cm);
+        $teacher = self::getDataGenerator()->create_user();
+        $role = $DB->get_record('role', array('shortname' => 'teacher'), '*', MUST_EXIST);
+        self::getDataGenerator()->enrol_user($teacher->id, $course1->id, $role->id);
+        groups_add_member($group2->id, $teacher->id);
+        self::setUser($teacher);
+        $discussions = mod_forum_external::get_discussion_posts_by_userid($user2->id, $forum1->cmid, 'modified', 'DESC');
+        $discussions = external_api::clean_returnvalue(mod_forum_external::get_discussion_posts_by_userid_returns(), $discussions);
+        // Discussion is only 1 record (group 2).
+        $this->assertEquals(1, count($discussions['discussions']));
+        $this->assertEquals($expectedposts['discussions'][1], $discussions['discussions'][0]);
     }
 
     /**