canvas_sync 0.27.12 → 0.27.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a0cb609547db9a99f1706791e88585c33a02d1d23d0163550ca042fe7a6fc6c2
-  data.tar.gz: 16685b41f9bbea87d8c3df59e26ede34d1de8d087204727d0a62af4b8ccdc1de
+  metadata.gz: 2d0d5545af44d472c6222d3d26833a90f795d05ce045eb029bc493b542d16799
+  data.tar.gz: caffe0593b173610b3a56f60459b2ba4fb8dc8d7239e018f766856f9b49cc1a1
 SHA512:
-  metadata.gz: 7815652b4cfdf053ee6f30e8546af592bf60c4e0c21538667d3608d8dd90557f3b4543552a6ea901a0d2027073fe764f06a014afba5ab72004e50b1fc10da325
-  data.tar.gz: 7db6393f537f9f585086166baf39f988da1f146e0cbf79ada0a7e015734f7e139757593e344940e65160add7efc8090638b1990a1e575ff772ee53c7949f00d5
+  metadata.gz: e507c8517386c294feaa221a8d7b28dd82ac9b578b08bf8dfce7398b73f653f79169251768a80e3f6fecd83000b0cce99448c505178538b0700ace4596513e0f
+  data.tar.gz: a543d2656184f1150bbb5ff38bdaeb6a4fe2e3d18efa7b94ff1364080715ef92f12ea43ede0059c7c104f8c9878b151559fffaa3865de4555114095706fdf223

data/lib/canvas_sync/concerns/ability_helper.rb

@@ -98,18 +98,59 @@ module CanvasSync::Concerns
       canvas_roles.where.not(base_role_type: 'AccountMembership')
     end
 
+    ACCOUNT_ADMIN_ROLE_LABELS = ["AccountAdmin", "Account Admin"].freeze
+
+    # True for an Admin of the Account this Tool is installed on. Note that
+    # `:root` is PandaPal's install-Account sense of "root" — the top of what
+    # this Tool can see — and not necessarily Canvas's own root Account.
     def canvas_super_user?
       canvas_account_admin?(:root)
     end
 
+    # True when the User administers +account+, INCLUDING by way of an Admin
+    # role held on an Account above it: in Canvas an Account Admin administers
+    # their Account and everything beneath it, so checking only the exact
+    # Account under-reports. Where a Tool is installed on a sub-account, that
+    # under-reporting inverted this check both ways — a genuine higher-level
+    # admin was rejected while a lower-scoped one was accepted.
     def canvas_account_admin?(account = launch_account)
-      panda_pal_session.cache([:canvas_account_admin?, account]) do
-        panda_pal_session.canvas_site_admin? || (panda_pal_session.canvas_account_role_labels(account) & ["AccountAdmin", "Account Admin"]).present?
+      # The `:inherited` cache-key segment is load-bearing, not decoration:
+      # #cache persists into the Session row, so sessions created before the
+      # traversal existed hold a cached `false` under the old key. Keying the
+      # new semantics separately retires those answers instead of serving
+      # stale denials to already-launched sessions.
+      panda_pal_session.cache([:canvas_account_admin?, account, :inherited]) do
+        panda_pal_session.canvas_site_admin? ||
+          (account_role_labels(account) & ACCOUNT_ADMIN_ROLE_LABELS).present?
       end
     end
 
     def canvas_user_id
       user&.canvas_id || panda_pal_session.get_lti_cust_param('canvas_user_id')
     end
+
+    private
+
+    # Feature-detected rather than version-pinned: CanvasSync deliberately
+    # declares no dependency on PandaPal (only this concern assumes one), so it
+    # cannot require >= 5.17 where `inherited:` was introduced. Detecting the
+    # keyword makes the upgrade order between the two gems irrelevant, instead
+    # of failing an authorization check with ArgumentError.
+    def account_role_labels(account)
+      if accepts_inherited_kwarg?
+        panda_pal_session.canvas_account_role_labels(account, inherited: true)
+      else
+        panda_pal_session.canvas_account_role_labels(account)
+      end
+    end
+
+    # `**opts` counts as support: a host app that wraps or decorates the Session
+    # commonly forwards keywords that way, and treating it as "too old" would
+    # silently drop the traversal for exactly the apps most likely to subclass.
+    def accepts_inherited_kwarg?
+      panda_pal_session.method(:canvas_account_role_labels).parameters.any? do |type, name|
+        type == :keyrest || ((type == :key || type == :keyreq) && name == :inherited)
+      end
+    end
   end
 end

data/lib/canvas_sync/jobs/report_sync_task.rb

@@ -27,12 +27,15 @@ module CanvasSync
       class << self
         def from_context
           report_batch = JobBatches::Batch.current
-          base_context = report_batch&.parent&.context
           state = report_batch&.context
-          return nil unless state.present?
+
+          # Only a report Batch carries :report_class. Any other Batch in the chain inherits a
+          # context from its parents, so check for the key itself rather than asking whether the
+          # context is present.
+          return nil if state.nil? || state[:report_class].blank?
 
           cls = state[:report_class].constantize
-          cls.new(state[:report_options], base_context, state)
+          cls.new(state[:report_options], report_batch.parent&.context, state)
         end
 
         def perform_later(options)

data/lib/canvas_sync/version.rb

@@ -1,3 +1,3 @@
 module CanvasSync
-  VERSION = "0.27.12".freeze
+  VERSION = "0.27.14".freeze
 end

data/spec/canvas_sync/concerns/ability_helper_spec.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Focused on what this concern contributes on top of PandaPal: that it asks for
+# INHERITED role labels, and that it keys its Session-persisted cache so the
+# pre-traversal answers don't outlive the change. The traversal itself belongs
+# to (and is tested by) PandaPal::Session#canvas_account_role_labels.
+#
+# panda_pal is not in this gem's bundle, so the session is a hand-rolled double
+# — which is also the only way to assert the exact call that gets made.
+RSpec.describe CanvasSync::Concerns::AbilityHelper do
+  let(:helper_class) do
+    Class.new do
+      include CanvasSync::Concerns::AbilityHelper
+
+      attr_reader :panda_pal_session
+
+      def initialize(session)
+        @panda_pal_session = session
+      end
+    end
+  end
+
+  # Shared bookkeeping: real #cache semantics (memoised into the session under
+  # an arbitrary key), plus a record of every call made.
+  session_base = Class.new do
+    attr_reader :cache_keys, :label_calls
+
+    def initialize(labels: [], site_admin: false, preset_cache: {})
+      @labels = labels
+      @site_admin = site_admin
+      @cache = preset_cache
+      @cache_keys = []
+      @label_calls = []
+    end
+
+    def cache(key)
+      @cache_keys << key
+      return @cache[key] if @cache.key?(key)
+
+      @cache[key] = yield
+    end
+
+    def canvas_site_admin?
+      @site_admin
+    end
+  end
+
+  # Declared exactly as PandaPal >= 5.17 declares it, so keyword detection runs
+  # against a real signature rather than a catch-all that would pass for the
+  # wrong reason.
+  let(:modern_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self', inherited: false)
+        @label_calls << [account, { inherited: inherited }]
+        @labels
+      end
+    end
+  end
+
+  # PandaPal < 5.17: no keyword at all. Passing one must not reach it.
+  let(:legacy_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self')
+        @label_calls << [account, {}]
+        @labels
+      end
+    end
+  end
+
+  # A host app decorating the Session and forwarding keywords.
+  let(:forwarding_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self', **opts)
+        @label_calls << [account, opts]
+        @labels
+      end
+    end
+  end
+
+  def helper_for(klass = nil, **kwargs)
+    helper_class.new((klass || modern_session).new(**kwargs))
+  end
+
+  describe "#canvas_account_admin?" do
+    it "asks PandaPal for inherited role labels" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, { inherited: true }]])
+    end
+
+    it "accepts the human-readable \"Account Admin\" label" do
+      expect(helper_for(labels: ["Account Admin"]).canvas_account_admin?(300)).to be true
+    end
+
+    it "is false when the user holds only non-admin roles anywhere in the chain" do
+      expect(helper_for(labels: ["Ops", "Department Admin"]).canvas_account_admin?(300)).to be false
+    end
+
+    it "is true for a Canvas site admin regardless of role labels" do
+      expect(helper_for(labels: [], site_admin: true).canvas_account_admin?(300)).to be true
+    end
+
+    it "keys its cache separately from the pre-traversal answer" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      helper.canvas_account_admin?(:root)
+
+      expect(helper.panda_pal_session.cache_keys).to eq([[:canvas_account_admin?, :root, :inherited]])
+    end
+
+    # The regression this guards: a Session launched before the traversal
+    # existed has `false` persisted under the OLD key. Reusing that key would
+    # keep denying an admin who should now pass.
+    it "ignores a stale pre-traversal cache entry" do
+      helper = helper_class.new(
+        modern_session.new(labels: ["AccountAdmin"], preset_cache: { [:canvas_account_admin?, :root] => false })
+      )
+
+      expect(helper.canvas_account_admin?(:root)).to be true
+    end
+
+    it "still memoises within its own key" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      helper.canvas_account_admin?(:root)
+      helper.canvas_account_admin?(:root)
+
+      expect(helper.panda_pal_session.label_calls.size).to eq(1)
+    end
+  end
+
+  describe "#canvas_super_user?" do
+    it "delegates to canvas_account_admin? for the install Account" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      expect(helper.canvas_super_user?).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[:root, { inherited: true }]])
+    end
+
+    it "is false for a user with no admin role above or at the install Account" do
+      expect(helper_for(labels: []).canvas_super_user?).to be false
+    end
+  end
+
+  # Upgrade-order safety: an app on a CanvasSync with this change but PandaPal
+  # < 5.17 must not blow up an authorization check with ArgumentError.
+  describe "keyword detection" do
+    it "falls back to the non-inherited call against an older PandaPal" do
+      helper = helper_for(legacy_session, labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, {}]])
+    end
+
+    it "treats a keyword-forwarding Session as supporting inherited" do
+      helper = helper_for(forwarding_session, labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, { inherited: true }]])
+    end
+  end
+end

data/spec/canvas_sync/jobs/report_sync_task_spec.rb

@@ -86,6 +86,30 @@ RSpec.describe CanvasSync::Jobs::ReportSyncTask do
   end
 
   describe ".from_context" do
+    # Stands in for JobBatches::ContextHash, which reads keys via #[] but routes every other Hash
+    # method through #flatten. Flattening loads (and locks down) the whole ancestor chain, so
+    # from_context has to stay on #[] - anything else costs the Batch the ability to record its
+    # own progress later in the job.
+    class FlattenTattlingContext
+      attr_reader :flatten_count
+
+      def initialize(hash)
+        @hash = hash.with_indifferent_access
+        @flatten_count = 0
+      end
+
+      def [](key)
+        @hash[key]
+      end
+
+      def flatten
+        @flatten_count += 1
+        @hash
+      end
+
+      delegate_missing_to :flatten
+    end
+
     it "reconstructs task from batch context" do
       stub_batch_context({ canvas_term_id: 1 })
       allow(CanvasSync::JobBatches::Batch.current).to receive(:context)
@@ -96,6 +120,38 @@ RSpec.describe CanvasSync::Jobs::ReportSyncTask do
       expect(task).to be_a(SyncSpecsTask)
       expect(task.options).to eq({ include_all: true })
     end
+
+    it "returns nil when the context belongs to a non-report Batch" do
+      # A Batch elsewhere in the sync chain inherits a context from its parents, so the context is
+      # populated - it just has no :report_class.
+      stub_batch_context({ canvas_term_id: 1 })
+      allow(CanvasSync::JobBatches::Batch.current).to receive(:context)
+        .and_return({ sync_batch_id: 42, account_id: 'self' }.with_indifferent_access)
+
+      expect(CanvasSync::Jobs::ReportSyncTask.from_context).to be_nil
+    end
+
+    it "returns nil when there is no current Batch" do
+      allow(CanvasSync::JobBatches::Batch).to receive(:current).and_return(nil)
+
+      expect(CanvasSync::Jobs::ReportSyncTask.from_context).to be_nil
+    end
+
+    it "does not flatten the context, for a report Batch or any other" do
+      report_context = FlattenTattlingContext.new(
+        report_class: 'SyncSpecsTask', report_options: { include_all: true }
+      )
+      other_context = FlattenTattlingContext.new(sync_batch_id: 42)
+
+      [report_context, other_context].each do |context|
+        stub_batch_context({ canvas_term_id: 1 })
+        allow(CanvasSync::JobBatches::Batch.current).to receive(:context).and_return(context)
+
+        CanvasSync::Jobs::ReportSyncTask.from_context
+
+        expect(context.flatten_count).to eq(0)
+      end
+    end
   end
 
   describe described_class::StarterJob do