Fix unsaved changes to annotations being lost when changing permissions

When changing permissions via the dropdown menu,
the changed permissions were applied to the _domain model_
representing the saved annotation instead of the _view model_
representing the current annotation being edited.

The change to the domain model triggered a reset of the view
model via AnnotationController.render(), losing any unsaved edits.

This commit makes AnnotationController.setPrivacy() apply permissions
changes to the view model in the same way as other edits in the
annotation view. These then only take effect when the 'Post to'
button is clicked.

Fixes #2567

h/static/scripts/directive/annotation.coffee

@@ -98,7 +98,7 @@ AnnotationController = [
     # @returns {boolean} True if the annotation is private to the current user.
     ###
     this.isPrivate = ->
-      permissions.isPrivate model.permissions, model.user
+      permissions.isPrivate @annotation.permissions, model.user
 
     ###*
     # @ngdoc method
@@ -107,7 +107,7 @@ AnnotationController = [
     # current group or with everyone).
     ###
     this.isShared = ->
-      permissions.isPublic model.permissions, model.group
+      permissions.isPublic @annotation.permissions, model.group
 
     ###*
     # @ngdoc method
@@ -117,12 +117,14 @@ AnnotationController = [
     # level. The supported levels are 'private' which makes the annotation
     # visible only to its creator and 'shared' which makes the annotation
     # visible to everyone in the group.
+    #
+    # The changes take effect when the annotation is saved
     ###
     this.setPrivacy = (privacy) ->
       if privacy == 'private'
-        model.permissions = permissions.private()
+        @annotation.permissions = permissions.private()
       else if privacy == 'shared'
-        model.permissions = permissions.public(model.group)
+        @annotation.permissions = permissions.public(model.group)
 
     ###*
     # @ngdoc method
@@ -352,7 +354,8 @@ AnnotationController = [
       updateTimestamp = angular.noop
       drafts.remove model
 
-    # Watch the model.
+    # watch for changes to the domain model and recreate the view model
+    # when it changes
     # XXX: TODO: don't clobber the view when collaborating
     $scope.$watch (-> model), (model, old) =>
       if model.updated != old.updated

h/static/scripts/directive/test/annotation-test.coffee

@@ -184,12 +184,26 @@ describe 'annotation', ->
       createDirective()
 
     it 'makes the annotation private when level is "private"', ->
+      annotation.$update = sinon.stub().returns(Promise.resolve())
+      controller.edit();
       controller.setPrivacy('private')
-      assert.deepEqual(annotation.permissions, {read: ['justme']})
+      # verify that permissions are not updated until the annotation
+      # is saved
+      assert.deepEqual(annotation.permissions, {})
+      controller.save().then(->
+        # verify that the permissions are updated once the annotation
+        # is saved
+        assert.deepEqual(annotation.permissions, {read: ['justme']})
+      )
 
     it 'makes the annotation shared when level is "shared"', ->
+      annotation.$update = sinon.stub().returns(Promise.resolve())
+      controller.edit();
       controller.setPrivacy('shared')
-      assert.deepEqual(annotation.permissions, {read: ['everybody']});
+      assert.deepEqual(annotation.permissions, {})
+      controller.save().then(->
+        assert.deepEqual(annotation.permissions, {read: ['everybody']})
+      )
 
   describe '#hasContent', ->
     beforeEach ->