Initialize group and permissions of new replies before creating them

Previously the `group` and `permissions` properties of new replies were
set _after_ creating the reply with `createAnnotation()`. This meant
that the new reply did not have the correct group and permissions when
it was filtered for the first time by the `buildThread()` function.

h/static/scripts/directive/annotation.js

@@ -359,19 +359,18 @@ function AnnotationController(
     */
   vm.reply = function() {
     var references = (vm.annotation.references || []).concat(vm.annotation.id);
-    var reply = annotationMapper.createAnnotation({
-      references: references,
-      uri: vm.annotation.uri
-    });
-    reply.group = vm.annotation.group;
-
+    var group = vm.annotation.group;
+    var replyPermissions;
     if (session.state.userid) {
-      if (vm.state().isPrivate) {
-        reply.permissions = permissions.private();
-      } else {
-        reply.permissions = permissions.shared(reply.group);
-      }
+      replyPermissions = vm.state().isPrivate ?
+        permissions.private() : permissions.shared(group);
     }
+    annotationMapper.createAnnotation({
+      group: group,
+      references: references,
+      permissions: replyPermissions,
+      uri: vm.annotation.uri,
+    });
   };
 
   /**

h/static/scripts/directive/test/annotation-test.js

@@ -474,57 +474,36 @@ describe('annotation', function() {
 
       it('creates a new reply with the proper uri and references', function() {
         var controller = createDirective(annotation).controller;
-        controller.reply();
-        var match = sinon.match({
+        var reply = sinon.match({
           references: [annotation.id],
           uri: annotation.uri
         });
-        assert.calledWith(fakeAnnotationMapper.createAnnotation, match);
-      });
-
-      it('makes the annotation shared if the parent is shared', function() {
-        var controller = createDirective(annotation).controller;
-        var reply = {};
-        fakeAnnotationMapper.createAnnotation.returns(reply);
-        fakePermissions.isShared.returns(true);
         controller.reply();
-        assert.deepEqual(reply.permissions, {
-          read: ['everybody']
-        });
+        assert.calledWith(fakeAnnotationMapper.createAnnotation, reply);
       });
 
-      it('makes the annotation shared if the parent is shared', function() {
-        var annotation = fixtures.defaultAnnotation();
-        annotation.group = 'my group';
-        annotation.permissions = {
-          read: ['my-group'],
-        };
+      it('makes the reply shared if the parent is shared', function() {
         var controller = createDirective(annotation).controller;
-        var reply = {};
-        fakeAnnotationMapper.createAnnotation.returns(reply);
-        fakePermissions.isShared = function(permissions, group) {
-          return permissions.read.indexOf(group) !== -1;
-        };
-        fakePermissions.shared = function(group) {
-          return {
-            read: [group]
-          };
-        };
+        var perms = {read: ['agroup']};
+        var reply = sinon.match({
+          references: [annotation.id],
+          permissions: perms,
+          uri: annotation.uri
+        });
+        fakePermissions.isShared.returns(true);
+        fakePermissions.shared.returns(perms);
         controller.reply();
-        assert.notEqual(reply.permissions.read.indexOf('my group'), -1);
+        assert.calledWith(fakeAnnotationMapper.createAnnotation, reply);
       });
 
-      it(
-        'does not add the world readable principal if the parent is private',
-        function() {
+      it('makes the reply private if the parent is private', function() {
           var controller = createDirective(annotation).controller;
           fakePermissions.isPrivate.returns(true);
-          var reply = {};
-          fakeAnnotationMapper.createAnnotation.returns(reply);
+          var perms = {read: ['onlyme']};
+          fakePermissions.private.returns(perms);
+          var reply = sinon.match({permissions: perms});
           controller.reply();
-          assert.deepEqual(reply.permissions, {
-            read: ['justme']
-          });
+          assert.calledWith(fakeAnnotationMapper.createAnnotation, reply);
         }
       );
 
@@ -532,10 +511,9 @@ describe('annotation', function() {
         var annotation = fixtures.defaultAnnotation();
         annotation.group = 'my group';
         var controller = createDirective(annotation).controller;
-        var reply = {};
-        fakeAnnotationMapper.createAnnotation.returns(reply);
+        var reply = sinon.match({group: annotation.group});
         controller.reply();
-        assert.equal(reply.group, annotation.group);
+        assert.calledWith(fakeAnnotationMapper.createAnnotation, reply);
       });
     });