FIX: staff-only tags visible on /tags page when restricted to a category

If a tag group is set to only be visible to staff, and is restricted
to a category that is visible by everyone, the tags in the group were
being shown on the /tags page. They weren't visible anywhere else.
This commit fixes it so they don't show on the /tags page.

app/models/tag_group.rb

@@ -68,14 +68,19 @@ class TagGroup < ActiveRecord::Base
     if guardian.is_staff?
       TagGroup
     else
+      # (
+      #   tag group is restricted to a category you can see
+      #   OR
+      #   tag group is not restricted to any categories
+      # )
+      # AND tag group can be seen by everyone
       filter_sql = <<~SQL
         (
           id IN (SELECT tag_group_id FROM category_tag_groups WHERE category_id IN (?))
-        ) OR (
+          OR
           id NOT IN (SELECT tag_group_id FROM category_tag_groups)
-          AND
-          id IN (SELECT tag_group_id FROM tag_group_permissions WHERE group_id = ?)
         )
+        AND id IN (SELECT tag_group_id FROM tag_group_permissions WHERE group_id = ?)
       SQL
 
       TagGroup.where(filter_sql, guardian.allowed_category_ids, Group::AUTO_GROUPS[:everyone])

spec/models/tag_group_spec.rb

@@ -52,6 +52,7 @@ describe TagGroup do
       staff_only_tag_group.save!
     end
 
+    shared_examples "correct visible tag groups" do
       it "returns correct groups based on category & tag group permissions" do
         expect(TagGroup.visible(Guardian.new(admin)).pluck(:name)).to match_array(TagGroup.pluck(:name))
         expect(TagGroup.visible(Guardian.new(moderator)).pluck(:name)).to match_array(TagGroup.pluck(:name))
@@ -72,4 +73,16 @@ describe TagGroup do
         ])
       end
     end
+
+    include_examples "correct visible tag groups"
+
+    context "staff-only tag group restricted to a public category" do
+      before do
+        public_category.allowed_tag_groups = [public_tag_group.name, staff_only_tag_group.name]
+        private_category.allowed_tag_groups = [private_tag_group.name, staff_only_tag_group.name]
+      end
+
+      include_examples "correct visible tag groups"
+    end
+  end
 end