GET post/:id is always returning empty completed_stages for stages that are internal use only

[tuxpiper]

Describe the bug
On the API, when obtaining posts with stages that are marked for internal use only, those stages are never shown as completed.

Where was the bug observed
All current API deployments.

To Reproduce
Steps to reproduce the behavior:

As admin / post manager:

1. Create survey with stages that are for internal use only
2. Create post for the newly created survey
3. Mark the internal use stages as complete
4. Retrieve your post
5. Observe how internal use stages are not marked complete

Expected behavior
Internal use stages should appear as complete to

Is there a workaround? What is it.
No

Additional context
Looking at the fixtures we use in the API integration tests, none of the survey stages defined there are marked as internal use only. This would explain why this problem is not making tests fail.

This is what I suspect to be the root of the problem:

platform/src/App/Repository/PostRepository.php

Line 134 in 27920b0

$excludeStages = $this->form_stage_repo->getHiddenStageIds(

. This operation is done without checking the user permissions , and the resulting value is later on used to filter out which stages are reported as complete.

Aha! Link: https://ushahiditeam.aha.io/features/PROD-183