coalescing_panda 5.0.0.beta.1 → 5.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 04cba708232c8e0c9b6a463672856af29a163ea5c99f3f1f3cc9a25574384e4a
-  data.tar.gz: 4bf9e5644ef1d4224de236ae57cd966eda287ca1942b8bc6f5350362dc6e2a64
+  metadata.gz: 306dfeeb30b6ae7918306493e16fad1153218caff10326e85e20767fe65e6939
+  data.tar.gz: 8e1d71edd52810dc203bffabc505f4bf1d594b9dd6a41af69850d00d9a7a49bf
 SHA512:
-  metadata.gz: 4d58f85ac65e2bc2374dfa77ded152c6afd0193c46a0c28f0ef19b14270112888d553efdb22d063a44c31257cd70e0ac5aa9173c2f830da5e1722765bfee85aa
-  data.tar.gz: b59db693a31dc3fe091aa4bfa7838008a43b69f5a4c486dd55a74bcf684a88be3719eff5bc0bdf63ba043111a36324c45584bd0dc39084069daad62a09ecdb37
+  metadata.gz: c07375ac5edf196130f97ad74d87b78895c0c75ee22452b739932b525a5cb79a29e6e4a751ad0addf2e92782e466f4403ace209399245d5fb0d26f20764e892d
+  data.tar.gz: 923158157e37c46b0374ccebcd5b3c9dac3e7f70d2df759aa6f340fec35f4b179b2fc3fe8ac51babe7a95ea0f569ff066f07bd46ee536e5679ad89da3b77472e

data/app/assets/config/coalescing_panda/manifest.js

@@ -0,0 +1,3 @@
+//= link_tree ../../images
+//= link_directory ../../javascripts/coalescing_panda/ .js
+//= link_directory ../../stylesheets/coalescing_panda/ .css

data/app/controllers/coalescing_panda/oauth2_controller.rb

@@ -7,6 +7,8 @@ module CoalescingPanda
     end
 
     def redirect
+      use_secure_headers_override(:allow_inline_scripts)
+
       if !params[:error] && retrieve_oauth_state
         lti_account = LtiAccount.find_by_key(@oauth_state.data[:key])
         client_id = lti_account.oauth2_client_id

data/app/models/coalescing_panda/json_with_indifferent_access.rb

@@ -0,0 +1,13 @@
+module CoalescingPanda
+  class JSONWithIndifferentAccess
+    def self.load(str)
+      return nil unless str.present?
+      parsed = JSON.parse(str)
+      parsed.is_a?(Hash) ? HashWithIndifferentAccess.new(parsed) : parsed
+    end
+
+    def self.dump(obj)
+      JSON.dump(obj)
+    end
+  end
+end

data/app/models/coalescing_panda/persistent_session.rb

@@ -1,10 +1,11 @@
 module CoalescingPanda
   class PersistentSession < ActiveRecord::Base
-    serialize :data, Hash
+    serialize :data, JSONWithIndifferentAccess
     belongs_to :coalescing_panda_lti_account, :class_name => 'CoalescingPanda::LtiAccount'
     validates :coalescing_panda_lti_account_id, presence: true
 
     after_initialize do
+      self.data ||= {}
       self.session_key ||= SecureRandom.urlsafe_base64(60)
     end
 

data/lib/coalescing_panda/controller_helpers.rb

@@ -2,15 +2,32 @@ require 'browser'
 
 module CoalescingPanda
   module ControllerHelpers
+    extend ActiveSupport::Concern
+
+    included do
+      alias_method :rails_session, :session
+
+      helper_method :encrypted_session_key, :current_session_data, :current_session
+      append_after_action :save_session, if: -> { @current_session && session_changed? }
+    end
+
+    class_methods do
+      def use_native_sessions
+        after_action do
+          rails_session['persistent_session_key'] = current_session.session_key if @current_session.present?
+        end
+      end
+    end
+
     def current_session
-      @current_session ||= CoalescingPanda::PersistentSession.find_by(session_key: session_key) if session_key
-      @current_session ||= CoalescingPanda::PersistentSession.create_from_launch(params, current_lti_account.id)
+      @current_session ||= (CoalescingPanda::PersistentSession.find_by(session_key: session_key) if session_key)
+      @current_session ||= (CoalescingPanda::PersistentSession.create_from_launch(params, current_lti_account.id) if current_lti_account.present?)
       @current_session
     end
 
     def current_lti_account
-      @account ||= CoalescingPanda::LtiAccount.find_by!(key: organization_key) if organization_key
-      @account ||= CoalescingPanda::LtiAccount.find_by(id: organization_id) if organization_id
+      @account ||= (CoalescingPanda::LtiAccount.find_by!(key: organization_key) if organization_key)
+      @account ||= (CoalescingPanda::LtiAccount.find_by(id: organization_id) if organization_id)
       @account
     end
 
@@ -83,42 +100,42 @@ module CoalescingPanda
     end
 
     def check_refresh_token
-      return unless session['uri'] && session['user_id'] && session['oauth_consumer_key']
-      uri = BearcatUri.new(session['uri'])
-      api_auth = CanvasApiAuth.find_by(user_id: session['user_id'], api_domain: uri.api_domain)
-      @lti_account = LtiAccount.find_by(key: session['oauth_consumer_key'])
+      return unless current_session_data['uri'] && current_session_data['user_id'] && current_session_data['oauth_consumer_key']
+      uri = BearcatUri.new(current_session_data['uri'])
+      api_auth = CanvasApiAuth.find_by(user_id: current_session_data['user_id'], api_domain: uri.api_domain)
+      @lti_account = LtiAccount.find_by(key: current_session_data['oauth_consumer_key'])
       return if @lti_account.nil? || api_auth.nil? # Not all tools use oauth
 
       refresh_token(uri, api_auth) if api_auth.expired?
     rescue Footrest::HttpError::BadRequest
-      render_oauth2_page uri, session['user_id']
+      render_oauth2_page uri, current_session_data['user_id']
     end
 
     def set_session(launch_presentation_return_url)
-      session['user_id'] = params['user_id']
-      session['uri'] = launch_presentation_return_url
-      session['lis_person_sourcedid'] = params['lis_person_sourcedid']
-      session['oauth_consumer_key'] = params['oauth_consumer_key']
-      session['custom_canvas_account_id'] = params['custom_canvas_account_id']
+      current_session_data['user_id'] = params['user_id']
+      current_session_data['uri'] = launch_presentation_return_url
+      current_session_data['lis_person_sourcedid'] = params['lis_person_sourcedid']
+      current_session_data['oauth_consumer_key'] = params['oauth_consumer_key']
+      current_session_data['custom_canvas_account_id'] = params['custom_canvas_account_id']
     end
 
     def have_session?
-      if params['tool_consumer_instance_guid'] && session['user_id'] != params['user_id']
+      if params['tool_consumer_instance_guid'] && current_session_data['user_id'] != params['user_id']
         reset_session
         logger.info("resetting session params")
-        session['user_id'] = params['user_id']
+        current_session_data['user_id'] = params['user_id']
       end
 
-      if (session['user_id'] && session['uri'])
-        uri = BearcatUri.new(session['uri'])
-        api_auth = CanvasApiAuth.find_by('user_id = ? and api_domain = ?', session['user_id'], uri.api_domain)
+      if (current_session_data['user_id'] && current_session_data['uri'])
+        uri = BearcatUri.new(current_session_data['uri'])
+        api_auth = CanvasApiAuth.find_by('user_id = ? and api_domain = ?', current_session_data['user_id'], uri.api_domain)
         if api_auth && !api_auth.expired?
           @client = Bearcat::Client.new(token: api_auth.api_token, prefix: uri.prefix)
           @client.user_profile 'self'
         end
       end
 
-      @lti_account = LtiAccount.find_by_key(session['oauth_consumer_key']) if session['oauth_consumer_key']
+      @lti_account = LtiAccount.find_by_key(current_session_data['oauth_consumer_key']) if current_session_data['oauth_consumer_key']
 
       !!@client
     rescue Footrest::HttpError::Unauthorized
@@ -198,7 +215,7 @@ module CoalescingPanda
       if params[:encrypted_session_key]
         return msg_encryptor.decrypt_and_verify(params[:encrypted_session_key])
       end
-      params[:session_key] || session_key_header
+      params[:session_key] || session_key_header || rails_session['persistent_session_key']
     end
 
     def session_key_header
@@ -218,26 +235,26 @@ module CoalescingPanda
     # nicely with webpack-dev-server live reloading (otherwise
     # you get an access error every time it tries to live reload).
 
-    def redirect_with_session_to(path, id_or_resource = nil, params = {})
-      if Rails.env.development?
-        redirect_development_mode(path, id_or_resource, params)
+    def redirect_with_session_to(path, id_or_resource = nil, redirect_params = {})
+      if Rails.env.development? || Rails.env.test?
+        redirect_development_mode(path, id_or_resource, redirect_params)
       else
-        redirect_production_mode(path, id_or_resource, params)
+        redirect_production_mode(path, id_or_resource, redirect_params)
       end
     end
 
-    def redirect_development_mode(path, id_or_resource = nil, params)
+    def redirect_development_mode(path, id_or_resource = nil, redirect_params)
       redirect_to send(path, id_or_resource, {
           session_key: current_session.session_key,
           organization_id: current_lti_account.id
-      }.merge(params))
+      }.merge(redirect_params))
     end
 
-    def redirect_production_mode(path, id_or_resource = nil, params)
+    def redirect_production_mode(path, id_or_resource = nil, redirect_params)
       redirect_to send(path, id_or_resource, {
           encrypted_session_key: encrypted_session_key,
           organization_id: current_lti_account.id
-      }.merge(params))
+      }.merge(redirect_params))
     end
 
   end

data/lib/coalescing_panda/engine.rb

@@ -25,6 +25,10 @@ module CoalescingPanda
       end
     end
 
+    initializer 'coalescing_panda.assets' do |app|
+      app.config.assets.precompile << 'coalescing_panda/manifest.js'
+    end
+
     initializer 'cloaescing_panda.route_helper' do |route|
       ActionDispatch::Routing::Mapper.send :include, CoalescingPanda::RouteHelpers
     end
@@ -50,6 +54,9 @@ module CoalescingPanda
         # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
         # DON'T ENABLE THIS FOR PRODUCTION!
         script_src << "'unsafe-eval'"
+      elsif CoalescingPanda.lti_options.has_key?(:allow_unsafe_eval) && CoalescingPanda.lti_options[:allow_unsafe_eval] == true
+        # For when code is returned from server and injected into dom.  Need to have unsafe-eval or it won't work.
+        script_src << "'unsafe-eval'"
       end
 
       SecureHeaders::Configuration.default do |config|
@@ -80,6 +87,10 @@ module CoalescingPanda
       SecureHeaders::Configuration.override(:safari_override) do |config|
         config.cookies = SecureHeaders::OPT_OUT
       end
+
+      SecureHeaders::Configuration.override(:allow_inline_scripts) do |config|
+        config.csp[:script_src] << "'unsafe-inline'"
+      end
     end
 
   end

data/lib/coalescing_panda/version.rb

@@ -1,3 +1,3 @@
 module CoalescingPanda
-  VERSION = '5.0.0.beta.1'
+  VERSION = '5.0.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: coalescing_panda
 version: !ruby/object:Gem::Version
-  version: 5.0.0.beta.1
+  version: 5.0.3
 platform: ruby
 authors:
 - Nathan Mills
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-03 00:00:00.000000000 Z
+date: 2020-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -400,6 +400,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - Rakefile
+- app/assets/config/coalescing_panda/manifest.js
 - app/assets/images/bootstrap/glyphicons-halflings-white.png
 - app/assets/images/bootstrap/glyphicons-halflings.png
 - app/assets/javascripts/coalescing_panda/application.js
@@ -422,6 +423,7 @@ files:
 - app/models/coalescing_panda/group.rb
 - app/models/coalescing_panda/group_category.rb
 - app/models/coalescing_panda/group_membership.rb
+- app/models/coalescing_panda/json_with_indifferent_access.rb
 - app/models/coalescing_panda/lti_account.rb
 - app/models/coalescing_panda/lti_nonce.rb
 - app/models/coalescing_panda/oauth_state.rb
@@ -563,9 +565,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubygems_version: 3.1.2
 signing_key: