canvas_sync 0.27.11 → 0.27.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83ea16b4fb4ba5a744d39a92d8145e5ebf1123355e5c6562094f91fe5d523176
-  data.tar.gz: 7505711d374c3f86648ce435234668df10a6c032dc6546cdf144c4b6d9d944f9
+  metadata.gz: 5b9df64b18232b05db0d002ff124845da7e8b5b04e712024047122e5ee3d228d
+  data.tar.gz: 9537a34a09178f945eca6342159b005491c38fb52848ebd1c095358a57718354
 SHA512:
-  metadata.gz: 9906d9f164b5cdae293e6ca6e249a7793988c951ea7f3d84500364e8e88f2184e8f1fc58d54e762f4854d4fa5f755115a99759fdeea1f3b5d56bde94181aca1a
-  data.tar.gz: a0b592ee83e841af466cd06d66f564d9e731f7398a9f400fa96da4807a0027dd5575163b60cc10351730b017bc15ff18fbbc8f2073ef48a2724d5529d70bbfd4
+  metadata.gz: '0647553723168ca27615daff30aa6a3ed746e68c11d559e51db31e6710a665572668765431ffcfe01f3db7807d2dd938be80f33987c47cd852477435264519a0'
+  data.tar.gz: 57031d7dd3884bbdf2f8c8af966e9ccdeb257011537aee39ba23ab261c3dee38b2dc32f69957b1d3d4d2b294d1fa0da88ff6736118091917b7b017830c9dfb1d

data/lib/canvas_sync/concerns/ability_helper.rb

@@ -98,18 +98,59 @@ module CanvasSync::Concerns
       canvas_roles.where.not(base_role_type: 'AccountMembership')
     end
 
+    ACCOUNT_ADMIN_ROLE_LABELS = ["AccountAdmin", "Account Admin"].freeze
+
+    # True for an Admin of the Account this Tool is installed on. Note that
+    # `:root` is PandaPal's install-Account sense of "root" — the top of what
+    # this Tool can see — and not necessarily Canvas's own root Account.
     def canvas_super_user?
       canvas_account_admin?(:root)
     end
 
+    # True when the User administers +account+, INCLUDING by way of an Admin
+    # role held on an Account above it: in Canvas an Account Admin administers
+    # their Account and everything beneath it, so checking only the exact
+    # Account under-reports. Where a Tool is installed on a sub-account, that
+    # under-reporting inverted this check both ways — a genuine higher-level
+    # admin was rejected while a lower-scoped one was accepted.
     def canvas_account_admin?(account = launch_account)
-      panda_pal_session.cache([:canvas_account_admin?, account]) do
-        panda_pal_session.canvas_site_admin? || (panda_pal_session.canvas_account_role_labels(account) & ["AccountAdmin", "Account Admin"]).present?
+      # The `:inherited` cache-key segment is load-bearing, not decoration:
+      # #cache persists into the Session row, so sessions created before the
+      # traversal existed hold a cached `false` under the old key. Keying the
+      # new semantics separately retires those answers instead of serving
+      # stale denials to already-launched sessions.
+      panda_pal_session.cache([:canvas_account_admin?, account, :inherited]) do
+        panda_pal_session.canvas_site_admin? ||
+          (account_role_labels(account) & ACCOUNT_ADMIN_ROLE_LABELS).present?
       end
     end
 
     def canvas_user_id
       user&.canvas_id || panda_pal_session.get_lti_cust_param('canvas_user_id')
     end
+
+    private
+
+    # Feature-detected rather than version-pinned: CanvasSync deliberately
+    # declares no dependency on PandaPal (only this concern assumes one), so it
+    # cannot require >= 5.17 where `inherited:` was introduced. Detecting the
+    # keyword makes the upgrade order between the two gems irrelevant, instead
+    # of failing an authorization check with ArgumentError.
+    def account_role_labels(account)
+      if accepts_inherited_kwarg?
+        panda_pal_session.canvas_account_role_labels(account, inherited: true)
+      else
+        panda_pal_session.canvas_account_role_labels(account)
+      end
+    end
+
+    # `**opts` counts as support: a host app that wraps or decorates the Session
+    # commonly forwards keywords that way, and treating it as "too old" would
+    # silently drop the traversal for exactly the apps most likely to subclass.
+    def accepts_inherited_kwarg?
+      panda_pal_session.method(:canvas_account_role_labels).parameters.any? do |type, name|
+        type == :keyrest || ((type == :key || type == :keyreq) && name == :inherited)
+      end
+    end
   end
 end

data/lib/canvas_sync/jobs/report_starter.rb

@@ -53,9 +53,13 @@ module CanvasSync
         processor_class = processor_class_name.constantize
         account_id = options[:account_id] || context[:account_id] || "self"
 
+        # The old ReportProcessorJob passed `batch_context.merge(options)` (e.g. sync_start_time)
+        # through to the processor; preserve that here for old custom Processor subclasses.
+        merged_options = state.merge(options)
+
         # The old processor signature: process(file_path, options, report_id)
         # Note: The third param was report_id in ReportProcessorJob but was account_id in practice
-        processor_class.process(file, options, account_id)
+        processor_class.process(file, merged_options, account_id)
       end
     end
   end

data/lib/canvas_sync/jobs/report_sync_task.rb

@@ -27,10 +27,15 @@ module CanvasSync
       class << self
         def from_context
           report_batch = JobBatches::Batch.current
-          base_context = report_batch.parent.context
-          state = report_batch.context
+          state = report_batch&.context
+
+          # Only a report Batch carries :report_class. Any other Batch in the chain inherits a
+          # context from its parents, so check for the key itself rather than asking whether the
+          # context is present.
+          return nil if state.nil? || state[:report_class].blank?
+
           cls = state[:report_class].constantize
-          cls.new(state[:report_options], base_context, state)
+          cls.new(state[:report_options], report_batch.parent&.context, state)
         end
 
         def perform_later(options)
@@ -141,10 +146,13 @@ module CanvasSync
       end
 
       def do_bulk_import(report_file_path, model, options: {}, mapping_key: nil, &blk)
-        Processors::ReportProcessor.new().do_bulk_import(report_file_path, model, options: options, mapping_key: mapping_key, &blk)
+        import_options = { sync_start_time: state[:sync_start_time] }.merge(options)
+        Processors::ReportProcessor.new().do_bulk_import(report_file_path, model, options: import_options, mapping_key: mapping_key, &blk)
       end
 
       class ReportTaskJob < CanvasSync::Job
+        discard_on FatalReportError
+
         protected
 
         def canvas_account_id

data/lib/canvas_sync/jobs/sync_accounts_job.rb

@@ -10,7 +10,8 @@ module CanvasSync
       # @param options [Hash]
       def perform(options)
         unless options[:root_account] == false
-          accid = report_task.options[:account_id] || batch_context[:account_id] || "self"
+          task = ReportSyncTask.from_context || nil
+          accid = options[:account_id] || task&.options&.dig(:account_id) || batch_context[:account_id] || "self"
           acc_params = CanvasSync.get_canvas_sync_client(batch_context).account(accid)
           update_or_create_model(Account, acc_params)
         end

data/lib/canvas_sync/jobs/sync_provisioning_report_job.rb

@@ -16,7 +16,7 @@ module CanvasSync
           params[model] = true
         end
 
-        merged_params = merge_report_params(options, params)
+        merged_params = merge_report_params(options, params).with_indifferent_access
 
         # Make sure the report also checks last_activity_at when checking updated_at
         if options[:models].include?("enrollments")

data/lib/canvas_sync/version.rb

@@ -1,3 +1,3 @@
 module CanvasSync
-  VERSION = "0.27.11".freeze
+  VERSION = "0.27.15".freeze
 end

data/lib/canvas_sync.rb

@@ -1,3 +1,4 @@
+require "active_support"
 require "bearcat"
 
 require "canvas_sync/version"
@@ -26,66 +27,53 @@ module CanvasSync
   JobBatches = Joblin::Batching
   JobUniqueness = Joblin::Uniqueness
 
-  SUPPORTED_MODELS = %w[
-    users
-    pseudonyms
-    courses
-    groups
-    group_memberships
-    accounts
-    terms
-    enrollments
-    sections
-    assignments
-    submissions
-    roles
-    admins
-    assignment_groups
-    context_modules
-    context_module_items
-    xlist
-    user_observers
-    grading_periods
-    grading_period_groups
-    content_migrations
-    learning_outcomes
-    learning_outcome_results
-    course_nicknames
-    rubrics
-    rubric_associations
-    rubric_assessments
-    course_progresses
-    assignment_overrides
-    scores
-  ].freeze
+  KNOWN_MODELS = {
+    users: { job: :provisioning, term_scoped: false },
+    pseudonyms: { job: :provisioning, term_scoped: false },
+    user_observers: { job: :provisioning, term_scoped: false },
+    grading_periods: { job: :provisioning, term_scoped: false },
+    grading_period_groups: { job: :provisioning, term_scoped: false },
+    learning_outcomes: { job: :provisioning, term_scoped: false },
+    learning_outcome_results: { job: :provisioning, term_scoped: false },
 
-  SUPPORTED_TERM_SCOPE_MODELS = %w[
-    assignments
-    submissions
-    assignment_groups
-    context_modules
-    context_module_items
-    rubrics
-    rubric_associations
-    rubric_assessments
-    course_progresses
-    assignment_overrides
-    scores
-  ].freeze
+    terms: { job: CanvasSync::Jobs::SyncTermsJob, term_scoped: false },
+    accounts: { job: CanvasSync::Jobs::SyncAccountsJob, term_scoped: false },
+    roles: { job: CanvasSync::Jobs::SyncRolesJob, term_scoped: false },
+    admins: { job: CanvasSync::Jobs::SyncAdminsJob, term_scoped: false },
 
-  DEFAULT_TERM_SCOPE_MODELS = %w[
-    assignments
-    submissions
-    assignment_groups
-    context_modules
-    context_module_items
-    rubrics
-    rubric_associations
-    rubric_assessments
-    course_progresses
-    assignment_overrides
-    scores
-  ].freeze
+    groups: { job: :provisioning, term_scoped: false },
+    group_memberships: { job: :provisioning, term_scoped: false },
+
+    courses: { job: :provisioning, term_scoped: true },
+    course_nicknames: { job: :provisioning, term_scoped: true },
+    sections: { job: :provisioning, term_scoped: true },
+    xlist: { job: :provisioning, term_scoped: true },
+
+    context_modules: { job: CanvasSync::Jobs::SyncContextModulesJob, term_scoped: true },
+    context_module_items: { job: CanvasSync::Jobs::SyncContextModuleItemsJob, term_scoped: true },
+    content_migrations: { job: CanvasSync::Jobs::SyncContentMigrationsJob, term_scoped: true },
+
+    enrollments: { job: :provisioning, term_scoped: true },
+    course_progresses: { job: CanvasSync::Jobs::SyncCourseProgressesJob, term_scoped: true },
+
+    assignments: { job: CanvasSync::Jobs::SyncAssignmentsJob, term_scoped: true },
+    assignment_groups: { job: CanvasSync::Jobs::SyncAssignmentGroupsJob, term_scoped: true },
+    assignment_overrides: { job: CanvasSync::Jobs::SyncAssignmentOverridesJob, term_scoped: true },
+    submissions: { job: CanvasSync::Jobs::SyncSubmissionsJob, term_scoped: true },
+    scores: { job: CanvasSync::Jobs::SyncScoresJob, term_scoped: true },
+
+    rubrics: { job: CanvasSync::Jobs::SyncRubricsJob, term_scoped: false },
+    rubric_associations: { job: CanvasSync::Jobs::SyncRubricAssociationsJob, term_scoped: false },
+    rubric_assessments: { job: CanvasSync::Jobs::SyncRubricAssessmentsJob, term_scoped: false },
+  }.with_indifferent_access.freeze
+
+  SUPPORTED_MODELS = KNOWN_MODELS.keys.map(&:to_s).freeze
+
+  SUPPORTED_TERM_SCOPE_MODELS = KNOWN_MODELS.select { |_, v| v[:term_scoped] }.keys.map(&:to_s).freeze
+
+  DEFAULT_TERM_SCOPE_MODELS = SUPPORTED_TERM_SCOPE_MODELS
+
+  PROVISIONING_REPORT_MODELS = KNOWN_MODELS.select { |_, v| v[:job] == :provisioning }.keys.map(&:to_s).freeze
 
   SUPPORTED_LIVE_EVENTS = %w[
     course
@@ -181,26 +169,7 @@ module CanvasSync
       options = options.deep_symbolize_keys!
 
       given_models = models.dup
-
-      model_job_map = {
-        terms: CanvasSync::Jobs::SyncTermsJob,
-        accounts: CanvasSync::Jobs::SyncAccountsJob,
-        roles: CanvasSync::Jobs::SyncRolesJob,
-        admins: CanvasSync::Jobs::SyncAdminsJob,
-
-        assignments: CanvasSync::Jobs::SyncAssignmentsJob,
-        submissions: CanvasSync::Jobs::SyncSubmissionsJob,
-        assignment_groups: CanvasSync::Jobs::SyncAssignmentGroupsJob,
-        assignment_overrides: CanvasSync::Jobs::SyncAssignmentOverridesJob,
-        context_modules: CanvasSync::Jobs::SyncContextModulesJob,
-        context_module_items: CanvasSync::Jobs::SyncContextModuleItemsJob,
-        content_migrations: CanvasSync::Jobs::SyncContentMigrationsJob,
-        course_progresses: CanvasSync::Jobs::SyncCourseProgressesJob,
-        rubrics: CanvasSync::Jobs::SyncRubricsJob,
-        rubric_associations: CanvasSync::Jobs::SyncRubricAssociationsJob,
-        rubric_assessments: CanvasSync::Jobs::SyncRubricAssessmentsJob,
-        scores: CanvasSync::Jobs::SyncScoresJob,
-      }.with_indifferent_access
+      term_scoped_models = term_scoped_models & SUPPORTED_TERM_SCOPE_MODELS
 
       root_chain = base_canvas_sync_chain(**kwargs, globals: options[:global] || kwargs[:globals])
       concurrent_root_chain = JobBatches::ChainBuilder.new(JobBatches::ConcurrentBatchJob)
@@ -210,7 +179,8 @@ module CanvasSync
 
       try_add_model_job = ->(model) {
         return unless models.include?(model)
-        current_chain << { job: model_job_map[model].to_s, options: options[model.to_sym] || {} }
+        return if KNOWN_MODELS[model][:job] == :provisioning
+        current_chain << { job: KNOWN_MODELS[model][:job].to_s, options: options[model.to_sym] || {} }
         models -= [model]
       }
 
@@ -218,20 +188,26 @@ module CanvasSync
       # General provisioning jobs (not term-scoped)
       ##############################
 
+      models -= ['terms']
+
       # Accounts, users, roles, and admins cannot be scoped to term
       try_add_model_job.call('accounts')
 
-      # These Models use the provisioning report, but are not term-scoped,
-      # so we sync them outside of the term scoping to ensure work is not duplicated
+      # We could safely remove the unless wrapping, but it allows us to just merge these models into
+      #  the later provisioning report so we do it w/ one report instead of two.
       unless term_scope == false
-        models -= (first_provisioning_models = models & ['users', 'pseudonyms', 'user_observers', 'grading_periods', 'grading_period_groups'])
+        # These Models use the provisioning report, but are not term-scoped,
+        # so we sync them outside of the term scoping to ensure work is not duplicated
+        first_provisioning_models = (models - term_scoped_models) & PROVISIONING_REPORT_MODELS
+        models -= first_provisioning_models
         current_chain.insert(generate_provisioning_jobs(first_provisioning_models, options))
       end
 
       try_add_model_job.call('roles')
       try_add_model_job.call('admins')
 
-      (SUPPORTED_TERM_SCOPE_MODELS - term_scoped_models).each do |mdl|
+      # (SUPPORTED_TERM_SCOPE_MODELS - term_scoped_models).each do |mdl|
+      (models - term_scoped_models).each do |mdl|
         try_add_model_job.call(mdl)
       end
 
@@ -241,22 +217,26 @@ module CanvasSync
 
       term_parent_chain = current_chain
 
-      per_term_chain = JobBatches::ChainBuilder.build(model_job_map[:terms], term_scope: term_scope)
+      per_term_chain = JobBatches::ChainBuilder.build(KNOWN_MODELS['terms'][:job].to_s, term_scope: term_scope)
       current_chain = per_term_chain
 
       term_scoped_models.each do |mdl|
         try_add_model_job.call(mdl)
       end
 
+      prov_rep_models = models & PROVISIONING_REPORT_MODELS
+      models -= prov_rep_models
       current_chain.insert(
-        generate_provisioning_jobs(models - ['terms'], options)
+        generate_provisioning_jobs(prov_rep_models, options)
       )
 
       # Skip syncing terms if not required
-      if !current_chain.empty? || (models & ['terms']).present?
+      if !current_chain.empty? || (given_models & ['terms']).present?
         term_parent_chain << per_term_chain
       end
 
+      raise ArgumentError, "Some models were not processed: #{models.join(', ')}" if models.present?
+
       ###############################
       # Wrap it all up
       ###############################