coalescing_panda 5.0.0 → 5.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d645cd8c2b844e464a37181c7810119004db0d11f74fb1293e97d7230412e8b3
-  data.tar.gz: e2741818208ab1301551d47c9063d20ee9bbb0a58e6db63b164cc068b0c2c76a
+  metadata.gz: 92bed66c0757318a64fada41a45e598216c1daefdd7b43c8adf0a58c9d5259af
+  data.tar.gz: d99684f401684ffdcb93ae63fe7ea49ba6ae4303db2e68ac43709e934b31ebeb
 SHA512:
-  metadata.gz: 6430b3b457aa5776cd8590228794fcb77537824dbec08356ae9a512bf268e357e9a0f7e0db900ffa33d1f261964b393443719aa4a407b61970b26b19e7f65ce7
-  data.tar.gz: 3a4853c0b20ffc72041e5157f5a0813a8c5e30c27648b23193fc9d94652adaeda01ded2ef829e6e70617d6a02a7e89841cd5615474d0c866242fc435ba0d3eca
+  metadata.gz: 8d1289c6a483a650b1e54a669ad2968cd1d3935e4ef3a67de130775cacfeab78a810ab7a736edb7b5a63b1960633f98fb8d813ceb0e3b6dd1e59d50448fa9697
+  data.tar.gz: a8b9d22ffc7262a1385e156915e382ef43bc0d3e68d9077032676c92b9e9dd466084289c143079e977ee20d82e7259a05496ed452798aaf3ae3306f9efe006b7

data/app/assets/config/coalescing_panda/manifest.js

@@ -0,0 +1,3 @@
+//= link_tree ../../images
+//= link_directory ../../javascripts/coalescing_panda/ .js
+//= link_directory ../../stylesheets/coalescing_panda/ .css

data/app/controllers/coalescing_panda/lti_controller.rb

@@ -17,7 +17,7 @@ module CoalescingPanda
       lti_nav[:account][:text] = params[:account_navigation_label] if params[:account_navigation_label].present?
       platform = 'canvas.instructure.com'
       host = "#{request.scheme}://#{request.host_with_port}"
-      tc = IMS::LTI::Services::ToolConfig.new(:title => lti_options[:title], :launch_url => ("#{host}#{lti_options[:launch_route]}") || 'ABC')
+      tc = IMS::LTI::ToolConfig.new(:title => lti_options[:title], :launch_url => ("#{host}#{lti_options[:launch_route]}") || 'ABC')
       tc.set_ext_param(platform, :domain, request.host)
       tc.set_ext_param(platform, :privacy_level, 'public')
       tc.set_custom_param(:custom_canvas_role, '$Canvas.membership.roles')

data/app/controllers/coalescing_panda/oauth2_controller.rb

@@ -7,6 +7,8 @@ module CoalescingPanda
     end
 
     def redirect
+      use_secure_headers_override(:allow_inline_scripts)
+
       if !params[:error] && retrieve_oauth_state
         lti_account = LtiAccount.find_by_key(@oauth_state.data[:key])
         client_id = lti_account.oauth2_client_id

data/app/models/coalescing_panda/json_with_indifferent_access.rb

@@ -0,0 +1,13 @@
+module CoalescingPanda
+  class JSONWithIndifferentAccess
+    def self.load(str)
+      return nil unless str.present?
+      parsed = JSON.parse(str)
+      parsed.is_a?(Hash) ? HashWithIndifferentAccess.new(parsed) : parsed
+    end
+
+    def self.dump(obj)
+      JSON.dump(obj)
+    end
+  end
+end

data/app/models/coalescing_panda/persistent_session.rb

@@ -1,10 +1,11 @@
 module CoalescingPanda
   class PersistentSession < ActiveRecord::Base
-    serialize :data, Hash
+    serialize :data, JSONWithIndifferentAccess
     belongs_to :coalescing_panda_lti_account, :class_name => 'CoalescingPanda::LtiAccount'
     validates :coalescing_panda_lti_account_id, presence: true
 
     after_initialize do
+      self.data ||= {}
       self.session_key ||= SecureRandom.urlsafe_base64(60)
     end
 

data/db/migrate/20131114150001_create_coalescing_panda_canvas_api_auths.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCanvasApiAuths < ActiveRecord::Migration
+class CreateCoalescingPandaCanvasApiAuths < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_canvas_api_auths do |t|
       t.string :user_id

data/db/migrate/20131118211442_create_coalescing_panda_lti_accounts.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaLtiAccounts < ActiveRecord::Migration
+class CreateCoalescingPandaLtiAccounts < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_lti_accounts do |t|
       t.string :name

data/db/migrate/20131119165343_create_coalescing_panda_lti_nonces.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaLtiNonces < ActiveRecord::Migration
+class CreateCoalescingPandaLtiNonces < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_lti_nonces do |t|
       t.belongs_to :coalescing_panda_lti_account

data/db/migrate/20140904223159_create_coalescing_panda_sessions.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSessions < ActiveRecord::Migration
+class CreateCoalescingPandaSessions < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_sessions do |t|
       t.string :token

data/db/migrate/20141119225319_create_coalescing_panda_terms.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaTerms < ActiveRecord::Migration
+class CreateCoalescingPandaTerms < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_terms do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141119225721_create_coalescing_panda_courses.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCourses < ActiveRecord::Migration
+class CreateCoalescingPandaCourses < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_courses do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141120151432_create_coalescing_panda_sections.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSections < ActiveRecord::Migration
+class CreateCoalescingPandaSections < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_sections do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20141120151940_create_coalescing_panda_assignments.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaAssignments < ActiveRecord::Migration
+class CreateCoalescingPandaAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_assignments do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20141120152458_create_coalescing_panda_users.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaUsers < ActiveRecord::Migration
+class CreateCoalescingPandaUsers < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_users do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141120152546_create_coalescing_panda_submissions.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSubmissions < ActiveRecord::Migration
+class CreateCoalescingPandaSubmissions < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_submissions do |t|
       t.belongs_to :coalescing_panda_user, null: false

data/db/migrate/20141120153135_create_coalescing_panda_enrollments.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaEnrollments < ActiveRecord::Migration
+class CreateCoalescingPandaEnrollments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_enrollments do |t|
       t.belongs_to :coalescing_panda_user, null: false

data/db/migrate/20141121174846_create_coalescing_panda_canvas_batches.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCanvasBatches < ActiveRecord::Migration
+class CreateCoalescingPandaCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_canvas_batches do |t|
       t.float :percent_complete, default: 0.0

data/db/migrate/20141124160857_create_delayed_jobs.rb

@@ -1,4 +1,4 @@
-class CreateDelayedJobs < ActiveRecord::Migration
+class CreateDelayedJobs < CoalescingPanda::MiscHelper::MigrationClass
   def self.up
     create_table :delayed_jobs, :force => true do |table|
       table.integer :priority, :default => 0, :null => false # Allows some jobs to jump to the front of the queue

data/db/migrate/20141208221740_add_submission_types_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddSubmissionTypesToAssignments < ActiveRecord::Migration
+class AddSubmissionTypesToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :submission_types, :text
   end

data/db/migrate/20150106175418_add_group_category_id_to_assignment.rb

@@ -1,4 +1,4 @@
-class AddGroupCategoryIdToAssignment < ActiveRecord::Migration
+class AddGroupCategoryIdToAssignment < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :group_category_id, :integer
     add_column :coalescing_panda_assignments, :grade_group_students_individually, :boolean

data/db/migrate/20150106180131_add_published_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddPublishedToAssignments < ActiveRecord::Migration
+class AddPublishedToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :published, :boolean
   end

data/db/migrate/20150107205405_create_coalescing_panda_groups.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroups < ActiveRecord::Migration
+class CreateCoalescingPandaGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_groups do |t|
       t.belongs_to :context, polymorphic: true

data/db/migrate/20150107205413_create_coalescing_panda_group_memberships.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroupMemberships < ActiveRecord::Migration
+class CreateCoalescingPandaGroupMemberships < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_group_memberships do |t|
       t.belongs_to :coalescing_panda_group

data/db/migrate/20150210180516_add_context_to_canvas_batch.rb

@@ -1,4 +1,4 @@
-class AddContextToCanvasBatch < ActiveRecord::Migration
+class AddContextToCanvasBatch < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :context_id, :integer
     add_column :coalescing_panda_canvas_batches, :context_type, :string

data/db/migrate/20150506183335_create_coalescing_panda_assignment_groups.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaAssignmentGroups < ActiveRecord::Migration
+class CreateCoalescingPandaAssignmentGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_assignment_groups do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20150506192717_add_assignment_group_id_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddAssignmentGroupIdToAssignments < ActiveRecord::Migration
+class AddAssignmentGroupIdToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :coalescing_panda_assignment_group_id, :integer
   end

data/db/migrate/20150526144713_add_account_to_canvas_batches.rb

@@ -1,4 +1,4 @@
-class AddAccountToCanvasBatches < ActiveRecord::Migration
+class AddAccountToCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :coalescing_panda_lti_account_id, :integer, index: true
   end

data/db/migrate/20150602205257_add_option_to_canvas_batches.rb

@@ -1,4 +1,4 @@
-class AddOptionToCanvasBatches < ActiveRecord::Migration
+class AddOptionToCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :options, :text
   end

data/db/migrate/20150708192717_add_group_moderator_to_group_memberships.rb

@@ -1,4 +1,4 @@
-class AddGroupModeratorToGroupMemberships < ActiveRecord::Migration
+class AddGroupModeratorToGroupMemberships < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_group_memberships, :moderator, :boolean
   end

data/db/migrate/20150709192717_add_leader_id_to_groups.rb

@@ -1,4 +1,4 @@
-class AddLeaderIdToGroups < ActiveRecord::Migration
+class AddLeaderIdToGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_groups, :leader_id, :integer
     add_foreign_key :coalescing_panda_groups, :coalescing_panda_users, column: :leader_id, primary_key: "id"

data/db/migrate/20150714205405_create_coalescing_panda_group_categories.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroupCategories < ActiveRecord::Migration
+class CreateCoalescingPandaGroupCategories < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_group_categories do |t|
       t.belongs_to :context, polymorphic: true

data/db/migrate/20150811140030_add_fields_to_users.rb

@@ -1,4 +1,4 @@
-class AddFieldsToUsers < ActiveRecord::Migration
+class AddFieldsToUsers < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_users, :login_id, :string
   end

data/db/migrate/20151209155923_add_refresh_settings_to_canvas_api_auth.rb

@@ -1,4 +1,4 @@
-class AddRefreshSettingsToCanvasApiAuth < ActiveRecord::Migration
+class AddRefreshSettingsToCanvasApiAuth < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_api_auths, :refresh_token, :string
     add_column :coalescing_panda_canvas_api_auths, :expires_at, :datetime

data/db/migrate/20160830183155_create_coalescing_panda_oauth_states.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaOauthStates < ActiveRecord::Migration
+class CreateCoalescingPandaOauthStates < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_oauth_states do |t|
       t.string :state_key

data/db/migrate/20200528224505_create_coalescing_panda_persistent_session.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaPersistentSession < ActiveRecord::Migration
+class CreateCoalescingPandaPersistentSession < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_persistent_sessions do |t|
       t.string :session_key

data/lib/coalescing_panda/controller_helpers.rb

@@ -2,15 +2,32 @@ require 'browser'
 
 module CoalescingPanda
   module ControllerHelpers
+    extend ActiveSupport::Concern
+
+    included do
+      alias_method :rails_session, :session
+
+      helper_method :encrypted_session_key, :current_session_data, :current_session
+      append_after_action :save_session, if: -> { @current_session && session_changed? }
+    end
+
+    class_methods do
+      def use_native_sessions
+        after_action do
+          rails_session['persistent_session_key'] = current_session.session_key if @current_session.present?
+        end
+      end
+    end
+
     def current_session
-      @current_session ||= CoalescingPanda::PersistentSession.find_by(session_key: session_key) if session_key
-      @current_session ||= CoalescingPanda::PersistentSession.create_from_launch(params, current_lti_account.id)
+      @current_session ||= (CoalescingPanda::PersistentSession.find_by(session_key: session_key) if session_key)
+      @current_session ||= (CoalescingPanda::PersistentSession.create_from_launch(params, current_lti_account.id) if current_lti_account.present?)
       @current_session
     end
 
     def current_lti_account
-      @account ||= CoalescingPanda::LtiAccount.find_by!(key: organization_key) if organization_key
-      @account ||= CoalescingPanda::LtiAccount.find_by(id: organization_id) if organization_id
+      @account ||= (CoalescingPanda::LtiAccount.find_by!(key: organization_key) if organization_key)
+      @account ||= (CoalescingPanda::LtiAccount.find_by(id: organization_id) if organization_id)
       @account
     end
 
@@ -83,42 +100,42 @@ module CoalescingPanda
     end
 
     def check_refresh_token
-      return unless session['uri'] && session['user_id'] && session['oauth_consumer_key']
-      uri = BearcatUri.new(session['uri'])
-      api_auth = CanvasApiAuth.find_by(user_id: session['user_id'], api_domain: uri.api_domain)
-      @lti_account = LtiAccount.find_by(key: session['oauth_consumer_key'])
+      return unless current_session_data['uri'] && current_session_data['user_id'] && current_session_data['oauth_consumer_key']
+      uri = BearcatUri.new(current_session_data['uri'])
+      api_auth = CanvasApiAuth.find_by(user_id: current_session_data['user_id'], api_domain: uri.api_domain)
+      @lti_account = LtiAccount.find_by(key: current_session_data['oauth_consumer_key'])
       return if @lti_account.nil? || api_auth.nil? # Not all tools use oauth
 
       refresh_token(uri, api_auth) if api_auth.expired?
     rescue Footrest::HttpError::BadRequest
-      render_oauth2_page uri, session['user_id']
+      render_oauth2_page uri, current_session_data['user_id']
     end
 
     def set_session(launch_presentation_return_url)
-      session['user_id'] = params['user_id']
-      session['uri'] = launch_presentation_return_url
-      session['lis_person_sourcedid'] = params['lis_person_sourcedid']
-      session['oauth_consumer_key'] = params['oauth_consumer_key']
-      session['custom_canvas_account_id'] = params['custom_canvas_account_id']
+      current_session_data['user_id'] = params['user_id']
+      current_session_data['uri'] = launch_presentation_return_url
+      current_session_data['lis_person_sourcedid'] = params['lis_person_sourcedid']
+      current_session_data['oauth_consumer_key'] = params['oauth_consumer_key']
+      current_session_data['custom_canvas_account_id'] = params['custom_canvas_account_id']
     end
 
     def have_session?
-      if params['tool_consumer_instance_guid'] && session['user_id'] != params['user_id']
+      if params['tool_consumer_instance_guid'] && current_session_data['user_id'] != params['user_id']
         reset_session
         logger.info("resetting session params")
-        session['user_id'] = params['user_id']
+        current_session_data['user_id'] = params['user_id']
       end
 
-      if (session['user_id'] && session['uri'])
-        uri = BearcatUri.new(session['uri'])
-        api_auth = CanvasApiAuth.find_by('user_id = ? and api_domain = ?', session['user_id'], uri.api_domain)
+      if (current_session_data['user_id'] && current_session_data['uri'])
+        uri = BearcatUri.new(current_session_data['uri'])
+        api_auth = CanvasApiAuth.find_by('user_id = ? and api_domain = ?', current_session_data['user_id'], uri.api_domain)
         if api_auth && !api_auth.expired?
           @client = Bearcat::Client.new(token: api_auth.api_token, prefix: uri.prefix)
           @client.user_profile 'self'
         end
       end
 
-      @lti_account = LtiAccount.find_by_key(session['oauth_consumer_key']) if session['oauth_consumer_key']
+      @lti_account = LtiAccount.find_by_key(current_session_data['oauth_consumer_key']) if current_session_data['oauth_consumer_key']
 
       !!@client
     rescue Footrest::HttpError::Unauthorized
@@ -129,8 +146,8 @@ module CoalescingPanda
       authorized = false
       if (@lti_account = params['oauth_consumer_key'] && LtiAccount.find_by_key(params['oauth_consumer_key']))
         sanitized_params = sanitize_params
-        authenticator = IMS::LTI::Services::MessageAuthenticator.new(request.original_url, sanitized_params, @lti_account.secret)
-        authorized = authenticator.valid_signature?
+        @tp = IMS::LTI::ToolProvider.new(@lti_account.key, @lti_account.secret, sanitized_params)
+        authorized = @tp.valid_request?(request)
       end
       logger.info 'not authorized on tp valid request' unless authorized
       authorized = authorized && (roles.count == 0 || (roles & lti_roles).count > 0)
@@ -198,7 +215,7 @@ module CoalescingPanda
       if params[:encrypted_session_key]
         return msg_encryptor.decrypt_and_verify(params[:encrypted_session_key])
       end
-      params[:session_key] || session_key_header
+      params[:session_key] || session_key_header || rails_session['persistent_session_key']
     end
 
     def session_key_header

data/lib/coalescing_panda/engine.rb

@@ -1,4 +1,5 @@
 require 'secure_headers'
+require_relative './secure_headers'
 
 module CoalescingPanda
   class Engine < ::Rails::Engine
@@ -25,6 +26,10 @@ module CoalescingPanda
       end
     end
 
+    initializer 'coalescing_panda.assets' do |app|
+      app.config.assets.precompile << 'coalescing_panda/manifest.js'
+    end
+
     initializer 'cloaescing_panda.route_helper' do |route|
       ActionDispatch::Routing::Mapper.send :include, CoalescingPanda::RouteHelpers
     end
@@ -38,52 +43,21 @@ module CoalescingPanda
     end
 
     initializer :secure_headers do |app|
-      connect_src = %w('self')
-      script_src = %w('self')
-
-      if Rails.env.development?
-        # Allow webpack-dev-server to work
-        connect_src << "http://localhost:3035"
-        connect_src << "ws://localhost:3035"
-
-        # Allow stuff like rack-mini-profiler to work in development:
-        # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
-        # DON'T ENABLE THIS FOR PRODUCTION!
-        script_src << "'unsafe-eval'"
-      elsif CoalescingPanda.lti_options.has_key?(:allow_unsafe_eval) && CoalescingPanda.lti_options[:allow_unsafe_eval] == true
-        # For when code is returned from server and injected into dom.  Need to have unsafe-eval or it won't work.
-        script_src << "'unsafe-eval'"
-      end
-
-      SecureHeaders::Configuration.default do |config|
-        # The default cookie headers aren't compatible with PandaPal cookies currently
-        config.cookies = { samesite: { none: true } }
-
-        if Rails.env.production?
-          config.cookies[:secure] = true
+      begin
+        ::SecureHeaders::Configuration.default do |config|
+          CoalescingPanda::SecureHeaders.apply_defaults(config)
         end
-
-        # Need to allow LTI iframes
-        config.x_frame_options = "ALLOWALL"
-
-        config.x_content_type_options = "nosniff"
-        config.x_xss_protection = "1; mode=block"
-        config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
-
-        config.csp = {
-            default_src: %w('self'),
-            script_src: script_src,
-            # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
-            style_src: %w('self' 'unsafe-inline' blob: https://fonts.googleapis.com),
-            font_src: %w('self' data: https://fonts.gstatic.com),
-            connect_src: connect_src,
-        }
+      rescue ::SecureHeaders::Configuration::AlreadyConfiguredError
+        # The App already applied settings
       end
 
-      SecureHeaders::Configuration.override(:safari_override) do |config|
+      ::SecureHeaders::Configuration.override(:safari_override) do |config|
         config.cookies = SecureHeaders::OPT_OUT
       end
-    end
 
+      ::SecureHeaders::Configuration.override(:allow_inline_scripts) do |config|
+        config.csp[:script_src] << "'unsafe-inline'"
+      end
+    end
   end
 end

data/lib/coalescing_panda/misc_helper.rb

@@ -0,0 +1,13 @@
+module CoalescingPanda
+  module MiscHelper
+    MigrationClass = Rails.version < '5.0' ? ActiveRecord::Migration : ActiveRecord::Migration[4.2]
+
+    def self.to_boolean(v)
+      if Rails.version < '5.0'
+        ActiveRecord::Type::Boolean.new.type_cast_from_user("0")
+      else
+        ActiveRecord::Type::Boolean.new.deserialize('0')
+      end
+    end
+  end
+end

data/lib/coalescing_panda/secure_headers.rb

@@ -0,0 +1,84 @@
+module CoalescingPanda
+  module SecureHeaders
+    def self.apply_defaults(config)
+      @config = config
+      # The default cookie headers aren't compatable with CoalescingPanda cookies currenntly
+      config.cookies = { samesite: { none: true } }
+
+      if Rails.env.production?
+        config.cookies[:secure] = true
+      end
+
+      # Need to allow LTI iframes
+      config.x_frame_options = "ALLOWALL"
+
+      config.x_content_type_options = "nosniff"
+      config.x_xss_protection = "1; mode=block"
+      config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
+
+      config.csp ||= {}
+
+      csp_entry(:default_src, %w['self'])
+      csp_entry(:connect_src, %w['self'])
+      csp_entry(:script_src, %w['self'])
+
+      if Rails.env.development?
+        # Allow webpack-dev-server to work
+        csp_entry(:connect_src, "http://localhost:3035")
+        csp_entry(:connect_src, "ws://localhost:3035")
+
+        # Allow stuff like rack-mini-profiler to work in development:
+        # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
+        # DON'T ENABLE THIS FOR PRODUCTION!
+        csp_entry(:script_src, "'unsafe-eval'")
+
+        # Detect and permit Scout APM in Dev
+        if MiscHelper.to_boolean(ENV['SCOUT_DEV_TRACE'])
+          csp_entry(:default_src, 'https://scoutapm.com')
+          csp_entry(:default_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:script_src, "'unsafe-inline'")
+          csp_entry(:script_src, 'https://scoutapm.com')
+          csp_entry(:script_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:connect_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:style_src, 'https://scoutapm.com')
+          csp_entry(:style_src, 'https://apm.scoutapp.com')
+        end
+      end
+
+      if CoalescingPanda.lti_options.has_key?(:allow_unsafe_eval) && CoalescingPanda.lti_options[:allow_unsafe_eval] == true
+        # For when code is returned from server and injected into dom.  Need to have unsafe-eval or it won't work.
+        csp_entry(:script_src, "'unsafe-eval'")
+      end
+
+      # Detect and permit Sentry
+      if defined?(Raven) && Raven.configuration.server.present?
+        csp_entry(:connect_src, Raven.configuration.server)
+
+        # Report CSP Violations to Sentry
+        unless config.csp[:report_uri].present?
+          cfg = Raven.configuration
+          config.csp[:report_uri] = ["#{cfg.scheme}://#{cfg.host}/api/#{cfg.project_id}/security/?sentry_key=#{cfg.public_key}"] unless config.csp[:report_uri].present?
+        end
+      end
+
+      # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
+      csp_entry(:style_src, %w('self' 'unsafe-inline' blob: https://fonts.googleapis.com))
+      csp_entry(:font_src, %w('self' data: https://fonts.gstatic.com))
+
+      @config = nil
+
+      config
+    end
+
+    private
+
+    def self.csp_entry(key, *values)
+      values = values.flatten
+      @config.csp[key] ||= []
+      @config.csp[key] |= values
+    end
+  end
+end

data/lib/coalescing_panda/version.rb

@@ -1,3 +1,3 @@
 module CoalescingPanda
-  VERSION = '5.0.0'
+  VERSION = '5.0.6'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: coalescing_panda
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 5.0.6
 platform: ruby
 authors:
 - Nathan Mills
@@ -10,20 +10,20 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-04 00:00:00.000000000 Z
+date: 2020-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 4.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 4.2.1
 - !ruby/object:Gem::Dependency
@@ -72,16 +72,22 @@ dependencies:
   name: ims-lti
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.2.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.2.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: haml-rails
   requirement: !ruby/object:Gem::Requirement
@@ -400,6 +406,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - Rakefile
+- app/assets/config/coalescing_panda/manifest.js
 - app/assets/images/bootstrap/glyphicons-halflings-white.png
 - app/assets/images/bootstrap/glyphicons-halflings.png
 - app/assets/javascripts/coalescing_panda/application.js
@@ -422,6 +429,7 @@ files:
 - app/models/coalescing_panda/group.rb
 - app/models/coalescing_panda/group_category.rb
 - app/models/coalescing_panda/group_membership.rb
+- app/models/coalescing_panda/json_with_indifferent_access.rb
 - app/models/coalescing_panda/lti_account.rb
 - app/models/coalescing_panda/lti_nonce.rb
 - app/models/coalescing_panda/oauth_state.rb
@@ -479,7 +487,9 @@ files:
 - lib/coalescing_panda/bearcat_uri.rb
 - lib/coalescing_panda/controller_helpers.rb
 - lib/coalescing_panda/engine.rb
+- lib/coalescing_panda/misc_helper.rb
 - lib/coalescing_panda/route_helpers.rb
+- lib/coalescing_panda/secure_headers.rb
 - lib/coalescing_panda/version.rb
 - lib/tasks/coalescing_panda_tasks.rake
 - spec/controllers/coalescing_panda/canvas_batches_controller_spec.rb