canvas_sync 0.27.13 → 0.27.14

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 465e968a497bd2dc0bbba5d978bc37a42257122f74132e2f9d7a72c4ed7f9082
-  data.tar.gz: 113288ee3a4bea44ba48d837f917f111e8e0bb9de2f8e43c0d5e30eb78aa0361
+  metadata.gz: 2d0d5545af44d472c6222d3d26833a90f795d05ce045eb029bc493b542d16799
+  data.tar.gz: caffe0593b173610b3a56f60459b2ba4fb8dc8d7239e018f766856f9b49cc1a1
 SHA512:
-  metadata.gz: 2afe2d77cc726e26bdce33058d89bfd279f890dd5832c30c33575960387111f309ac15f6f2632406861cb1f3a4e34ce0ff16509612bb987f3e96974ceabc327b
-  data.tar.gz: 3c926ea08522792eae8fd6daaafcc343888aed77b55e943d1fca08a8ddf174d01db1fc26ebe786cd613eab18dc0d9d15221a2fe739a5a46d4dda4e626e48f498
+  metadata.gz: e507c8517386c294feaa221a8d7b28dd82ac9b578b08bf8dfce7398b73f653f79169251768a80e3f6fecd83000b0cce99448c505178538b0700ace4596513e0f
+  data.tar.gz: a543d2656184f1150bbb5ff38bdaeb6a4fe2e3d18efa7b94ff1364080715ef92f12ea43ede0059c7c104f8c9878b151559fffaa3865de4555114095706fdf223

data/lib/canvas_sync/concerns/ability_helper.rb

@@ -98,18 +98,59 @@ module CanvasSync::Concerns
       canvas_roles.where.not(base_role_type: 'AccountMembership')
     end
 
+    ACCOUNT_ADMIN_ROLE_LABELS = ["AccountAdmin", "Account Admin"].freeze
+
+    # True for an Admin of the Account this Tool is installed on. Note that
+    # `:root` is PandaPal's install-Account sense of "root" — the top of what
+    # this Tool can see — and not necessarily Canvas's own root Account.
     def canvas_super_user?
       canvas_account_admin?(:root)
     end
 
+    # True when the User administers +account+, INCLUDING by way of an Admin
+    # role held on an Account above it: in Canvas an Account Admin administers
+    # their Account and everything beneath it, so checking only the exact
+    # Account under-reports. Where a Tool is installed on a sub-account, that
+    # under-reporting inverted this check both ways — a genuine higher-level
+    # admin was rejected while a lower-scoped one was accepted.
     def canvas_account_admin?(account = launch_account)
-      panda_pal_session.cache([:canvas_account_admin?, account]) do
-        panda_pal_session.canvas_site_admin? || (panda_pal_session.canvas_account_role_labels(account) & ["AccountAdmin", "Account Admin"]).present?
+      # The `:inherited` cache-key segment is load-bearing, not decoration:
+      # #cache persists into the Session row, so sessions created before the
+      # traversal existed hold a cached `false` under the old key. Keying the
+      # new semantics separately retires those answers instead of serving
+      # stale denials to already-launched sessions.
+      panda_pal_session.cache([:canvas_account_admin?, account, :inherited]) do
+        panda_pal_session.canvas_site_admin? ||
+          (account_role_labels(account) & ACCOUNT_ADMIN_ROLE_LABELS).present?
       end
     end
 
     def canvas_user_id
       user&.canvas_id || panda_pal_session.get_lti_cust_param('canvas_user_id')
     end
+
+    private
+
+    # Feature-detected rather than version-pinned: CanvasSync deliberately
+    # declares no dependency on PandaPal (only this concern assumes one), so it
+    # cannot require >= 5.17 where `inherited:` was introduced. Detecting the
+    # keyword makes the upgrade order between the two gems irrelevant, instead
+    # of failing an authorization check with ArgumentError.
+    def account_role_labels(account)
+      if accepts_inherited_kwarg?
+        panda_pal_session.canvas_account_role_labels(account, inherited: true)
+      else
+        panda_pal_session.canvas_account_role_labels(account)
+      end
+    end
+
+    # `**opts` counts as support: a host app that wraps or decorates the Session
+    # commonly forwards keywords that way, and treating it as "too old" would
+    # silently drop the traversal for exactly the apps most likely to subclass.
+    def accepts_inherited_kwarg?
+      panda_pal_session.method(:canvas_account_role_labels).parameters.any? do |type, name|
+        type == :keyrest || ((type == :key || type == :keyreq) && name == :inherited)
+      end
+    end
   end
 end

data/lib/canvas_sync/version.rb

@@ -1,3 +1,3 @@
 module CanvasSync
-  VERSION = "0.27.13".freeze
+  VERSION = "0.27.14".freeze
 end

data/spec/canvas_sync/concerns/ability_helper_spec.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+# Focused on what this concern contributes on top of PandaPal: that it asks for
+# INHERITED role labels, and that it keys its Session-persisted cache so the
+# pre-traversal answers don't outlive the change. The traversal itself belongs
+# to (and is tested by) PandaPal::Session#canvas_account_role_labels.
+#
+# panda_pal is not in this gem's bundle, so the session is a hand-rolled double
+# — which is also the only way to assert the exact call that gets made.
+RSpec.describe CanvasSync::Concerns::AbilityHelper do
+  let(:helper_class) do
+    Class.new do
+      include CanvasSync::Concerns::AbilityHelper
+
+      attr_reader :panda_pal_session
+
+      def initialize(session)
+        @panda_pal_session = session
+      end
+    end
+  end
+
+  # Shared bookkeeping: real #cache semantics (memoised into the session under
+  # an arbitrary key), plus a record of every call made.
+  session_base = Class.new do
+    attr_reader :cache_keys, :label_calls
+
+    def initialize(labels: [], site_admin: false, preset_cache: {})
+      @labels = labels
+      @site_admin = site_admin
+      @cache = preset_cache
+      @cache_keys = []
+      @label_calls = []
+    end
+
+    def cache(key)
+      @cache_keys << key
+      return @cache[key] if @cache.key?(key)
+
+      @cache[key] = yield
+    end
+
+    def canvas_site_admin?
+      @site_admin
+    end
+  end
+
+  # Declared exactly as PandaPal >= 5.17 declares it, so keyword detection runs
+  # against a real signature rather than a catch-all that would pass for the
+  # wrong reason.
+  let(:modern_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self', inherited: false)
+        @label_calls << [account, { inherited: inherited }]
+        @labels
+      end
+    end
+  end
+
+  # PandaPal < 5.17: no keyword at all. Passing one must not reach it.
+  let(:legacy_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self')
+        @label_calls << [account, {}]
+        @labels
+      end
+    end
+  end
+
+  # A host app decorating the Session and forwarding keywords.
+  let(:forwarding_session) do
+    Class.new(session_base) do
+      def canvas_account_role_labels(account = 'self', **opts)
+        @label_calls << [account, opts]
+        @labels
+      end
+    end
+  end
+
+  def helper_for(klass = nil, **kwargs)
+    helper_class.new((klass || modern_session).new(**kwargs))
+  end
+
+  describe "#canvas_account_admin?" do
+    it "asks PandaPal for inherited role labels" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, { inherited: true }]])
+    end
+
+    it "accepts the human-readable \"Account Admin\" label" do
+      expect(helper_for(labels: ["Account Admin"]).canvas_account_admin?(300)).to be true
+    end
+
+    it "is false when the user holds only non-admin roles anywhere in the chain" do
+      expect(helper_for(labels: ["Ops", "Department Admin"]).canvas_account_admin?(300)).to be false
+    end
+
+    it "is true for a Canvas site admin regardless of role labels" do
+      expect(helper_for(labels: [], site_admin: true).canvas_account_admin?(300)).to be true
+    end
+
+    it "keys its cache separately from the pre-traversal answer" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      helper.canvas_account_admin?(:root)
+
+      expect(helper.panda_pal_session.cache_keys).to eq([[:canvas_account_admin?, :root, :inherited]])
+    end
+
+    # The regression this guards: a Session launched before the traversal
+    # existed has `false` persisted under the OLD key. Reusing that key would
+    # keep denying an admin who should now pass.
+    it "ignores a stale pre-traversal cache entry" do
+      helper = helper_class.new(
+        modern_session.new(labels: ["AccountAdmin"], preset_cache: { [:canvas_account_admin?, :root] => false })
+      )
+
+      expect(helper.canvas_account_admin?(:root)).to be true
+    end
+
+    it "still memoises within its own key" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      helper.canvas_account_admin?(:root)
+      helper.canvas_account_admin?(:root)
+
+      expect(helper.panda_pal_session.label_calls.size).to eq(1)
+    end
+  end
+
+  describe "#canvas_super_user?" do
+    it "delegates to canvas_account_admin? for the install Account" do
+      helper = helper_for(labels: ["AccountAdmin"])
+
+      expect(helper.canvas_super_user?).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[:root, { inherited: true }]])
+    end
+
+    it "is false for a user with no admin role above or at the install Account" do
+      expect(helper_for(labels: []).canvas_super_user?).to be false
+    end
+  end
+
+  # Upgrade-order safety: an app on a CanvasSync with this change but PandaPal
+  # < 5.17 must not blow up an authorization check with ArgumentError.
+  describe "keyword detection" do
+    it "falls back to the non-inherited call against an older PandaPal" do
+      helper = helper_for(legacy_session, labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, {}]])
+    end
+
+    it "treats a keyword-forwarding Session as supporting inherited" do
+      helper = helper_for(forwarding_session, labels: ["AccountAdmin"])
+
+      expect(helper.canvas_account_admin?(300)).to be true
+      expect(helper.panda_pal_session.label_calls).to eq([[300, { inherited: true }]])
+    end
+  end
+end