Expertiza - grades controller bug

While testing the fix for the grades privacy issue, I found another authorization inconsistency that I wanted to flag before deployment.

I verified that for a student account, the grades/view_team page behaves as expected: the page shows neutral labels such as Review 1, Review 2, and each review link opens the response details correctly.

However, when I tested the same view_team page with teaching staff accounts, I observed inconsistent behavior. A TA account and an instructor account were both able to see reviewer names on the grades heatmap, but when clicking those reviewer-name links to open the underlying review response, the system denied access with the message: “A teaching assistant is not allowed to view this/these response.” I also saw the same behavior with the instructor account I tested.

Based on my investigation, this appears to be an authorization mismatch between the grades page and the response detail page. The grades page is using one assignment-level teaching-staff check to decide whether reviewer identities should be shown, but response/view is performing a separate authorization check through response_edit_allowed?. My concern is that the response detail path may be resolving authorization against map.reviewer.assignment instead of the response map’s own assignment context. If so, that would explain why a teaching staff user can see reviewer names on the heatmap but is then blocked from viewing the actual response.

At the moment, this does not appear to expose private data to unauthorized students, so I do not believe it is in the same severity category as the original production privacy issue we fixed. Because of that, I think the current patch could still be deployed if we want to unblock the original security fix first, and I can work on this follow-up issue immediately afterward.

If you think this should be addressed before deployment, my suggested fix would be to unify the authorization logic used by grades/view_team and response/view so both rely on the same assignment context. Concretely, I would update the response authorization path to use the response map’s assignment directly, rather than the reviewer participant’s assignment, and then test TA/instructor access again to confirm that teaching staff who are authorized for the assignment can open the linked review details consistently.