canvas_sync 0.27.11 → 0.27.15

data/spec/canvas_sync/concerns/ability_helper_spec.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Focused on what this concern contributes on top of PandaPal: that it asks for
+# INHERITED role labels, and that it keys its Session-persisted cache so the
+# pre-traversal answers don't outlive the change. The traversal itself belongs
+# to (and is tested by) PandaPal::Session#canvas_account_role_labels.
+#
+# panda_pal is not in this gem's bundle, so the session is a hand-rolled double
+# — which is also the only way to assert the exact call that gets made.
+RSpec.describe CanvasSync::Concerns::AbilityHelper do
+  let(:helper_class) do
+    Class.new do
+      include CanvasSync::Concerns::AbilityHelper
+
+      attr_reader :panda_pal_session
+
+      def initialize(session)
+        @panda_pal_session = session
+      end
+    end
+  end
+
+  # Shared bookkeeping: real #cache semantics (memoised into the session under
+  # an arbitrary key), plus a record of every call made.
+  session_base = Class.new do
+    attr_reader :cache_keys, :label_calls
+
+    def initialize(labels: [], site_admin: false, preset_cache: {})
+      @labels = labels
+      @site_admin = site_admin
+      @cache = preset_cache
+      @cache_keys = []
+      @label_calls = []
+    end
+
+    def cache(key)
+      @cache_keys << key
+      return @cache[key] if @cache.key?(key)
+
+      @cache[key] = yield
+    end
+
+    def canvas_site_admin?
+      @site_admin
+    end
+  end
+
+  # Declared exactly as PandaPal >= 5.17 declares it, so keyword detection runs
+  # against a real signature rather than a catch-all that would pass for the
+  # wrong reason.
+  let(:modern_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self', inherited: false)
+        @label_calls << [account, { inherited: inherited }]
+        @labels
+      end
+    end
+  end
+
+  # PandaPal < 5.17: no keyword at all. Passing one must not reach it.
+  let(:legacy_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self')
+        @label_calls << [account, {}]
+        @labels
+      end
+    end
+  end
+
+  # A host app decorating the Session and forwarding keywords.
+  let(:forwarding_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self', **opts)
+        @label_calls << [account, opts]
+        @labels
+      end
+    end
+  end
+
+  def helper_for(klass = nil, **kwargs)
+    helper_class.new((klass || modern_session).new(**kwargs))
+  end
+
+  describe "#canvas_account_admin?" do
+    it "asks PandaPal for inherited role labels" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, { inherited: true }]])
+    end
+
+    it "accepts the human-readable \"Account Admin\" label" do
+      expect(helper_for(labels: ["Account Admin"]).canvas_account_admin?(300)).to be true
+    end
+
+    it "is false when the user holds only non-admin roles anywhere in the chain" do
+      expect(helper_for(labels: ["Ops", "Department Admin"]).canvas_account_admin?(300)).to be false
+    end
+
+    it "is true for a Canvas site admin regardless of role labels" do
+      expect(helper_for(labels: [], site_admin: true).canvas_account_admin?(300)).to be true
+    end
+
+    it "keys its cache separately from the pre-traversal answer" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      helper.canvas_account_admin?(:root)
+
+      expect(helper.panda_pal_session.cache_keys).to eq([[:canvas_account_admin?, :root, :inherited]])
+    end
+
+    # The regression this guards: a Session launched before the traversal
+    # existed has `false` persisted under the OLD key. Reusing that key would
+    # keep denying an admin who should now pass.
+    it "ignores a stale pre-traversal cache entry" do
+      helper = helper_class.new(
+        modern_session.new(labels: ["AccountAdmin"], preset_cache: { [:canvas_account_admin?, :root] => false })
+      )
+
+      expect(helper.canvas_account_admin?(:root)).to be true
+    end
+
+    it "still memoises within its own key" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      helper.canvas_account_admin?(:root)
+      helper.canvas_account_admin?(:root)
+
+      expect(helper.panda_pal_session.label_calls.size).to eq(1)
+    end
+  end
+
+  describe "#canvas_super_user?" do
+    it "delegates to canvas_account_admin? for the install Account" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      expect(helper.canvas_super_user?).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[:root, { inherited: true }]])
+    end
+
+    it "is false for a user with no admin role above or at the install Account" do
+      expect(helper_for(labels: []).canvas_super_user?).to be false
+    end
+  end
+
+  # Upgrade-order safety: an app on a CanvasSync with this change but PandaPal
+  # < 5.17 must not blow up an authorization check with ArgumentError.
+  describe "keyword detection" do
+    it "falls back to the non-inherited call against an older PandaPal" do
+      helper = helper_for(legacy_session, labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, {}]])
+    end
+
+    it "treats a keyword-forwarding Session as supporting inherited" do
+      helper = helper_for(forwarding_session, labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, { inherited: true }]])
+    end
+  end
+end

data/spec/canvas_sync/jobs/begin_sync_chain_job_spec.rb

@@ -170,22 +170,28 @@ RSpec.describe CanvasSync::Jobs::BeginSyncChainJob do
     end
 
     context 'a "<weekday>/<skip weeks>" schedule (e.g. "sunday/2")' do
+      # should_full_sync? asks DateTime.now (the system zone) which weekday it is, so
+      # these travel to local noon. Midnight in any single zone lands on the adjacent
+      # day for someone, which flips the weekday and the assertion with it.
+      let(:sunday) { Time.local(2024, 1, 7, 12, 0, 0) }
+      let(:monday) { Time.local(2024, 1, 8, 12, 0, 0) }
+
       it 'is true only on the matching weekday once the skip period has elapsed' do
-        Timecop.travel(DateTime.new(2024, 1, 7)) do # a Sunday
+        Timecop.travel(sunday) do
           CanvasSync::SyncBatch.create!(status: 'completed', full_sync: true, batch_genre: 'default', started_at: 3.weeks.ago)
           expect(job.should_full_sync?('sunday/2')).to eq(true)
         end
       end
 
       it 'is false on the matching weekday if the skip period has not yet elapsed' do
-        Timecop.travel(DateTime.new(2024, 1, 7)) do # a Sunday
+        Timecop.travel(sunday) do
           CanvasSync::SyncBatch.create!(status: 'completed', full_sync: true, batch_genre: 'default', started_at: 1.week.ago)
           expect(job.should_full_sync?('sunday/2')).to eq(false)
         end
       end
 
       it 'is false on a non-matching weekday even if the skip period has elapsed' do
-        Timecop.travel(DateTime.new(2024, 1, 8)) do # a Monday
+        Timecop.travel(monday) do
           CanvasSync::SyncBatch.create!(status: 'completed', full_sync: true, batch_genre: 'default', started_at: 3.weeks.ago)
           expect(job.should_full_sync?('sunday/2')).to eq(false)
         end

data/spec/canvas_sync/jobs/report_sync_task_spec.rb

@@ -86,6 +86,30 @@ RSpec.describe CanvasSync::Jobs::ReportSyncTask do
   end
 
   describe ".from_context" do
+    # Stands in for JobBatches::ContextHash, which reads keys via #[] but routes every other Hash
+    # method through #flatten. Flattening loads (and locks down) the whole ancestor chain, so
+    # from_context has to stay on #[] - anything else costs the Batch the ability to record its
+    # own progress later in the job.
+    class FlattenTattlingContext
+      attr_reader :flatten_count
+
+      def initialize(hash)
+        @hash = hash.with_indifferent_access
+        @flatten_count = 0
+      end
+
+      def [](key)
+        @hash[key]
+      end
+
+      def flatten
+        @flatten_count += 1
+        @hash
+      end
+
+      delegate_missing_to :flatten
+    end
+
     it "reconstructs task from batch context" do
       stub_batch_context({ canvas_term_id: 1 })
       allow(CanvasSync::JobBatches::Batch.current).to receive(:context)
@@ -96,6 +120,38 @@ RSpec.describe CanvasSync::Jobs::ReportSyncTask do
       expect(task).to be_a(SyncSpecsTask)
       expect(task.options).to eq({ include_all: true })
     end
+
+    it "returns nil when the context belongs to a non-report Batch" do
+      # A Batch elsewhere in the sync chain inherits a context from its parents, so the context is
+      # populated - it just has no :report_class.
+      stub_batch_context({ canvas_term_id: 1 })
+      allow(CanvasSync::JobBatches::Batch.current).to receive(:context)
+        .and_return({ sync_batch_id: 42, account_id: 'self' }.with_indifferent_access)
+
+      expect(CanvasSync::Jobs::ReportSyncTask.from_context).to be_nil
+    end
+
+    it "returns nil when there is no current Batch" do
+      allow(CanvasSync::JobBatches::Batch).to receive(:current).and_return(nil)
+
+      expect(CanvasSync::Jobs::ReportSyncTask.from_context).to be_nil
+    end
+
+    it "does not flatten the context, for a report Batch or any other" do
+      report_context = FlattenTattlingContext.new(
+        report_class: 'SyncSpecsTask', report_options: { include_all: true }
+      )
+      other_context = FlattenTattlingContext.new(sync_batch_id: 42)
+
+      [report_context, other_context].each do |context|
+        stub_batch_context({ canvas_term_id: 1 })
+        allow(CanvasSync::JobBatches::Batch.current).to receive(:context).and_return(context)
+
+        CanvasSync::Jobs::ReportSyncTask.from_context
+
+        expect(context.flatten_count).to eq(0)
+      end
+    end
   end
 
   describe described_class::StarterJob do

data/spec/canvas_sync/jobs/sync_accounts_job_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+RSpec.describe CanvasSync::Jobs::SyncAccountsJob do
+  describe '#perform' do
+    before do
+      allow(CanvasSync::Jobs::SyncAccountsJob::ReportTask).to receive(:perform_later)
+    end
+
+    it 'syncs the root account and then invokes the report task' do
+      expect {
+        described_class.perform_now({})
+      }.to change { Account.count }.by(1)
+
+      expect(a_request(:get, 'http://test.instructure.com/api/v1/accounts/self')).to have_been_made
+      expect(CanvasSync::Jobs::SyncAccountsJob::ReportTask).to have_received(:perform_later).with({})
+    end
+
+    it 'uses account_id from the options when present' do
+      described_class.perform_now({ account_id: 42 })
+
+      expect(a_request(:get, 'http://test.instructure.com/api/v1/accounts/42')).to have_been_made
+    end
+
+    it 'falls back to account_id from the batch context' do
+      set_batch_context(account_id: 7)
+
+      described_class.perform_now({})
+
+      expect(a_request(:get, 'http://test.instructure.com/api/v1/accounts/7')).to have_been_made
+    end
+
+    it 'skips the root account sync when root_account is false' do
+      expect {
+        described_class.perform_now({ root_account: false })
+      }.not_to change { Account.count }
+
+      expect(a_request(:get, %r{/api/v1/accounts/})).not_to have_been_made
+      expect(CanvasSync::Jobs::SyncAccountsJob::ReportTask).to have_received(:perform_later)
+    end
+  end
+end

data/spec/canvas_sync/jobs/sync_provisioning_report_job_spec.rb

@@ -17,7 +17,7 @@ RSpec.describe CanvasSync::Jobs::SyncProvisioningReportJob do
             'courses' => true,
             enrollment_term_id: term.canvas_id,
           }
-        })
+        }.with_indifferent_access)
       end
     end
 
@@ -33,7 +33,7 @@ RSpec.describe CanvasSync::Jobs::SyncProvisioningReportJob do
             'users' => true,
             'courses' => true,
           }
-        })
+        }.with_indifferent_access)
       end
     end
   end

data/spec/spec_helper.rb

@@ -78,7 +78,9 @@ def open_canvas_fixture(name)
   JSON.parse(data)
 end
 
-def canvas_sync_client
+# Mirrors the host-app hook CanvasSync.get_canvas_sync_client calls. It passes an
+# account ID when one is configured, so this has to accept an optional argument.
+def canvas_sync_client(account_id = nil)
   Bearcat::Client.new(token: 'cool-token', prefix: 'http://test.instructure.com')
 end
 

data/spec/support/fake_canvas.rb

@@ -16,6 +16,10 @@ class FakeCanvas < Sinatra::Base
     json_response 200, 'admins.json'
   end
 
+  get '/api/v1/accounts/:id' do
+    json_response 200, 'account.json'
+  end
+
   get '/sample_report_download' do
     json_response 200, 'terms.json'
   end

data/spec/support/fixtures/canvas_responses/account.json

@@ -0,0 +1,12 @@
+{
+  "id": 1,
+  "name": "Test Root Account",
+  "workflow_state": "active",
+  "parent_account_id": null,
+  "root_account_id": null,
+  "uuid": "abcDEF1234567890abcDEF1234567890abcDEF12",
+  "default_storage_quota_mb": 500,
+  "default_user_storage_quota_mb": 50,
+  "default_group_storage_quota_mb": 50,
+  "default_time_zone": "America/Denver"
+}