coalescing_panda 5.0.2 → 5.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 683daed32c44f738fe0747932f43a2be9ee00490ac44b6bbda7a0c5f2e513660
-  data.tar.gz: 893aca1614fee0eef49a1bf9eeb2f0b02de240df3168ae82940a0f102a7e6a30
+  metadata.gz: b00520a9558a0dbd2699d97b5f1163721dff23d0042be51b2df5cc220675a0a1
+  data.tar.gz: 7adaf679f268ebcd2e5695994d3b5b498eda1ee3078e3be617b5a47e24a04244
 SHA512:
-  metadata.gz: 5c1666f7c708b34cd1161e53fcc2346c5122fd847797d9d2ddb7e9887ddb30e4e54a8992fc50b7998bf15153f6fc3bd851a1542bf7b93e0de34fa3a5b7aff4ca
-  data.tar.gz: c385b2c0e634fa4edc0bef7c2f14f7b6c5c484e8c0cee109095aed1bc1fd57c91d742aa401e6f2ad85cf8aeb232c0dea60c9dbb4f149706edb24cd0713c7ae92
+  metadata.gz: 630ea590d568f2fc1839ed5b456eec95a8ab0fa43b8139a7c9c32d5c08eddbb557fbe6cd71b65a88b71e5d72ec61098252033772f18e863368f4475bc807ac96
+  data.tar.gz: 18622f8b4c058ca1d8d66626d7b5186083114dba571f5d0a2b7c3d12b75abea934a6b02b2e29612541674ac704c018da58c126bbf3ea58dcd06d66f7994c4878

data/app/controllers/coalescing_panda/canvas_batches_controller.rb

@@ -12,13 +12,13 @@ module CoalescingPanda
       @batch.status = 'Queued'
       @batch.save
       worker = CoalescingPanda::Workers::CourseMiner.new(@batch.context, @batch.options)
-      session[:canvas_batch_id] = worker.batch.id
+      current_session_data[:canvas_batch_id] = worker.batch.id
       worker.start(true)
       redirect_to :back
     end
 
     def clear_batch_session
-      session[:canvas_batch_id] = nil
+      current_session_data[:canvas_batch_id] = nil
       render nothing: true
     end
   end

data/app/controllers/coalescing_panda/lti_controller.rb

@@ -17,7 +17,7 @@ module CoalescingPanda
       lti_nav[:account][:text] = params[:account_navigation_label] if params[:account_navigation_label].present?
       platform = 'canvas.instructure.com'
       host = "#{request.scheme}://#{request.host_with_port}"
-      tc = IMS::LTI::Services::ToolConfig.new(:title => lti_options[:title], :launch_url => ("#{host}#{lti_options[:launch_route]}") || 'ABC')
+      tc = IMS::LTI::ToolConfig.new(:title => lti_options[:title], :launch_url => ("#{host}#{lti_options[:launch_route]}") || 'ABC')
       tc.set_ext_param(platform, :domain, request.host)
       tc.set_ext_param(platform, :privacy_level, 'public')
       tc.set_custom_param(:custom_canvas_role, '$Canvas.membership.roles')

data/app/helpers/coalescing_panda/canvas_batches_helper.rb

@@ -1,7 +1,7 @@
 module CoalescingPanda
   module CanvasBatchesHelper
     def current_batch
-      @current_batch ||= CoalescingPanda::CanvasBatch.find_by_id(session[:canvas_batch_id])
+      @current_batch ||= CoalescingPanda::CanvasBatch.find_by_id(current_session_data[:canvas_batch_id])
     end
   end
 end

data/app/models/coalescing_panda/json_with_indifferent_access.rb

@@ -0,0 +1,13 @@
+module CoalescingPanda
+  class JSONWithIndifferentAccess
+    def self.load(str)
+      return nil unless str.present?
+      parsed = JSON.parse(str)
+      parsed.is_a?(Hash) ? HashWithIndifferentAccess.new(parsed) : parsed
+    end
+
+    def self.dump(obj)
+      JSON.dump(obj)
+    end
+  end
+end

data/app/models/coalescing_panda/persistent_session.rb

@@ -1,10 +1,11 @@
 module CoalescingPanda
   class PersistentSession < ActiveRecord::Base
-    serialize :data, Hash
+    serialize :data, JSONWithIndifferentAccess
     belongs_to :coalescing_panda_lti_account, :class_name => 'CoalescingPanda::LtiAccount'
     validates :coalescing_panda_lti_account_id, presence: true
 
     after_initialize do
+      self.data ||= {}
       self.session_key ||= SecureRandom.urlsafe_base64(60)
     end
 

data/app/views/coalescing_panda/canvas_batches/_canvas_batch_flash.html.haml

@@ -1,4 +1,4 @@
 - if current_batch.present?
-  - path = CoalescingPanda::Engine.routes.url_helpers.canvas_batch_path(current_batch)
-  - clear_path = CoalescingPanda::Engine.routes.url_helpers.clear_batch_session_path
-  #batch-progress{data: {batch: current_batch.try(:to_json), url: path, clear_path: clear_path} }
+  - path = CoalescingPanda::Engine.routes.url_helpers.canvas_batch_path(current_batch) + "?encrypted_session_key=#{encrypted_session_key}"
+  - clear_path = CoalescingPanda::Engine.routes.url_helpers.clear_batch_session_path + "?encrypted_session_key=#{encrypted_session_key}"
+  #batch-progress{data: {batch: current_batch.try(:to_json), url: path, clear_path: clear_path} }

data/db/migrate/20131114150001_create_coalescing_panda_canvas_api_auths.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCanvasApiAuths < ActiveRecord::Migration
+class CreateCoalescingPandaCanvasApiAuths < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_canvas_api_auths do |t|
       t.string :user_id

data/db/migrate/20131118211442_create_coalescing_panda_lti_accounts.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaLtiAccounts < ActiveRecord::Migration
+class CreateCoalescingPandaLtiAccounts < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_lti_accounts do |t|
       t.string :name

data/db/migrate/20131119165343_create_coalescing_panda_lti_nonces.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaLtiNonces < ActiveRecord::Migration
+class CreateCoalescingPandaLtiNonces < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_lti_nonces do |t|
       t.belongs_to :coalescing_panda_lti_account

data/db/migrate/20140904223159_create_coalescing_panda_sessions.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSessions < ActiveRecord::Migration
+class CreateCoalescingPandaSessions < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_sessions do |t|
       t.string :token

data/db/migrate/20141119225319_create_coalescing_panda_terms.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaTerms < ActiveRecord::Migration
+class CreateCoalescingPandaTerms < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_terms do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141119225721_create_coalescing_panda_courses.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCourses < ActiveRecord::Migration
+class CreateCoalescingPandaCourses < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_courses do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141120151432_create_coalescing_panda_sections.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSections < ActiveRecord::Migration
+class CreateCoalescingPandaSections < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_sections do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20141120151940_create_coalescing_panda_assignments.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaAssignments < ActiveRecord::Migration
+class CreateCoalescingPandaAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_assignments do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20141120152458_create_coalescing_panda_users.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaUsers < ActiveRecord::Migration
+class CreateCoalescingPandaUsers < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_users do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141120152546_create_coalescing_panda_submissions.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSubmissions < ActiveRecord::Migration
+class CreateCoalescingPandaSubmissions < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_submissions do |t|
       t.belongs_to :coalescing_panda_user, null: false

data/db/migrate/20141120153135_create_coalescing_panda_enrollments.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaEnrollments < ActiveRecord::Migration
+class CreateCoalescingPandaEnrollments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_enrollments do |t|
       t.belongs_to :coalescing_panda_user, null: false

data/db/migrate/20141121174846_create_coalescing_panda_canvas_batches.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCanvasBatches < ActiveRecord::Migration
+class CreateCoalescingPandaCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_canvas_batches do |t|
       t.float :percent_complete, default: 0.0

data/db/migrate/20141124160857_create_delayed_jobs.rb

@@ -1,4 +1,4 @@
-class CreateDelayedJobs < ActiveRecord::Migration
+class CreateDelayedJobs < CoalescingPanda::MiscHelper::MigrationClass
   def self.up
     create_table :delayed_jobs, :force => true do |table|
       table.integer :priority, :default => 0, :null => false # Allows some jobs to jump to the front of the queue

data/db/migrate/20141208221740_add_submission_types_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddSubmissionTypesToAssignments < ActiveRecord::Migration
+class AddSubmissionTypesToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :submission_types, :text
   end

data/db/migrate/20150106175418_add_group_category_id_to_assignment.rb

@@ -1,4 +1,4 @@
-class AddGroupCategoryIdToAssignment < ActiveRecord::Migration
+class AddGroupCategoryIdToAssignment < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :group_category_id, :integer
     add_column :coalescing_panda_assignments, :grade_group_students_individually, :boolean

data/db/migrate/20150106180131_add_published_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddPublishedToAssignments < ActiveRecord::Migration
+class AddPublishedToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :published, :boolean
   end

data/db/migrate/20150107205405_create_coalescing_panda_groups.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroups < ActiveRecord::Migration
+class CreateCoalescingPandaGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_groups do |t|
       t.belongs_to :context, polymorphic: true

data/db/migrate/20150107205413_create_coalescing_panda_group_memberships.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroupMemberships < ActiveRecord::Migration
+class CreateCoalescingPandaGroupMemberships < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_group_memberships do |t|
       t.belongs_to :coalescing_panda_group

data/db/migrate/20150210180516_add_context_to_canvas_batch.rb

@@ -1,4 +1,4 @@
-class AddContextToCanvasBatch < ActiveRecord::Migration
+class AddContextToCanvasBatch < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :context_id, :integer
     add_column :coalescing_panda_canvas_batches, :context_type, :string

data/db/migrate/20150506183335_create_coalescing_panda_assignment_groups.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaAssignmentGroups < ActiveRecord::Migration
+class CreateCoalescingPandaAssignmentGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_assignment_groups do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20150506192717_add_assignment_group_id_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddAssignmentGroupIdToAssignments < ActiveRecord::Migration
+class AddAssignmentGroupIdToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :coalescing_panda_assignment_group_id, :integer
   end

data/db/migrate/20150526144713_add_account_to_canvas_batches.rb

@@ -1,4 +1,4 @@
-class AddAccountToCanvasBatches < ActiveRecord::Migration
+class AddAccountToCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :coalescing_panda_lti_account_id, :integer, index: true
   end

data/db/migrate/20150602205257_add_option_to_canvas_batches.rb

@@ -1,4 +1,4 @@
-class AddOptionToCanvasBatches < ActiveRecord::Migration
+class AddOptionToCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :options, :text
   end

data/db/migrate/20150708192717_add_group_moderator_to_group_memberships.rb

@@ -1,4 +1,4 @@
-class AddGroupModeratorToGroupMemberships < ActiveRecord::Migration
+class AddGroupModeratorToGroupMemberships < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_group_memberships, :moderator, :boolean
   end

data/db/migrate/20150709192717_add_leader_id_to_groups.rb

@@ -1,4 +1,4 @@
-class AddLeaderIdToGroups < ActiveRecord::Migration
+class AddLeaderIdToGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_groups, :leader_id, :integer
     add_foreign_key :coalescing_panda_groups, :coalescing_panda_users, column: :leader_id, primary_key: "id"

data/db/migrate/20150714205405_create_coalescing_panda_group_categories.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroupCategories < ActiveRecord::Migration
+class CreateCoalescingPandaGroupCategories < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_group_categories do |t|
       t.belongs_to :context, polymorphic: true

data/db/migrate/20150811140030_add_fields_to_users.rb

@@ -1,4 +1,4 @@
-class AddFieldsToUsers < ActiveRecord::Migration
+class AddFieldsToUsers < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_users, :login_id, :string
   end

data/db/migrate/20151209155923_add_refresh_settings_to_canvas_api_auth.rb

@@ -1,4 +1,4 @@
-class AddRefreshSettingsToCanvasApiAuth < ActiveRecord::Migration
+class AddRefreshSettingsToCanvasApiAuth < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_api_auths, :refresh_token, :string
     add_column :coalescing_panda_canvas_api_auths, :expires_at, :datetime

data/db/migrate/20160830183155_create_coalescing_panda_oauth_states.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaOauthStates < ActiveRecord::Migration
+class CreateCoalescingPandaOauthStates < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_oauth_states do |t|
       t.string :state_key

data/db/migrate/20200528224505_create_coalescing_panda_persistent_session.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaPersistentSession < ActiveRecord::Migration
+class CreateCoalescingPandaPersistentSession < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_persistent_sessions do |t|
       t.string :session_key

data/lib/coalescing_panda/controller_helpers.rb

@@ -2,15 +2,32 @@ require 'browser'
 
 module CoalescingPanda
   module ControllerHelpers
+    extend ActiveSupport::Concern
+
+    included do
+      alias_method :rails_session, :session
+
+      helper_method :encrypted_session_key, :current_session_data, :current_session
+      append_after_action :save_session, if: -> { @current_session && session_changed? }
+    end
+
+    class_methods do
+      def use_native_sessions
+        after_action do
+          rails_session['persistent_session_key'] = current_session.session_key if @current_session.present?
+        end
+      end
+    end
+
     def current_session
-      @current_session ||= CoalescingPanda::PersistentSession.find_by(session_key: session_key) if session_key
-      @current_session ||= CoalescingPanda::PersistentSession.create_from_launch(params, current_lti_account.id)
+      @current_session ||= (CoalescingPanda::PersistentSession.find_by(session_key: session_key) if session_key)
+      @current_session ||= (CoalescingPanda::PersistentSession.create_from_launch(params, current_lti_account.id) if current_lti_account.present?)
       @current_session
     end
 
     def current_lti_account
-      @account ||= CoalescingPanda::LtiAccount.find_by!(key: organization_key) if organization_key
-      @account ||= CoalescingPanda::LtiAccount.find_by(id: organization_id) if organization_id
+      @account ||= (CoalescingPanda::LtiAccount.find_by!(key: organization_key) if organization_key)
+      @account ||= (CoalescingPanda::LtiAccount.find_by(id: organization_id) if organization_id)
       @account
     end
 
@@ -83,42 +100,42 @@ module CoalescingPanda
     end
 
     def check_refresh_token
-      return unless session['uri'] && session['user_id'] && session['oauth_consumer_key']
-      uri = BearcatUri.new(session['uri'])
-      api_auth = CanvasApiAuth.find_by(user_id: session['user_id'], api_domain: uri.api_domain)
-      @lti_account = LtiAccount.find_by(key: session['oauth_consumer_key'])
+      return unless current_session_data['uri'] && current_session_data['user_id'] && current_session_data['oauth_consumer_key']
+      uri = BearcatUri.new(current_session_data['uri'])
+      api_auth = CanvasApiAuth.find_by(user_id: current_session_data['user_id'], api_domain: uri.api_domain)
+      @lti_account = LtiAccount.find_by(key: current_session_data['oauth_consumer_key'])
       return if @lti_account.nil? || api_auth.nil? # Not all tools use oauth
 
       refresh_token(uri, api_auth) if api_auth.expired?
     rescue Footrest::HttpError::BadRequest
-      render_oauth2_page uri, session['user_id']
+      render_oauth2_page uri, current_session_data['user_id']
     end
 
     def set_session(launch_presentation_return_url)
-      session['user_id'] = params['user_id']
-      session['uri'] = launch_presentation_return_url
-      session['lis_person_sourcedid'] = params['lis_person_sourcedid']
-      session['oauth_consumer_key'] = params['oauth_consumer_key']
-      session['custom_canvas_account_id'] = params['custom_canvas_account_id']
+      current_session_data['user_id'] = params['user_id']
+      current_session_data['uri'] = launch_presentation_return_url
+      current_session_data['lis_person_sourcedid'] = params['lis_person_sourcedid']
+      current_session_data['oauth_consumer_key'] = params['oauth_consumer_key']
+      current_session_data['custom_canvas_account_id'] = params['custom_canvas_account_id']
     end
 
     def have_session?
-      if params['tool_consumer_instance_guid'] && session['user_id'] != params['user_id']
+      if params['tool_consumer_instance_guid'] && current_session_data['user_id'] != params['user_id']
         reset_session
         logger.info("resetting session params")
-        session['user_id'] = params['user_id']
+        current_session_data['user_id'] = params['user_id']
       end
 
-      if (session['user_id'] && session['uri'])
-        uri = BearcatUri.new(session['uri'])
-        api_auth = CanvasApiAuth.find_by('user_id = ? and api_domain = ?', session['user_id'], uri.api_domain)
+      if (current_session_data['user_id'] && current_session_data['uri'])
+        uri = BearcatUri.new(current_session_data['uri'])
+        api_auth = CanvasApiAuth.find_by('user_id = ? and api_domain = ?', current_session_data['user_id'], uri.api_domain)
         if api_auth && !api_auth.expired?
           @client = Bearcat::Client.new(token: api_auth.api_token, prefix: uri.prefix)
           @client.user_profile 'self'
         end
       end
 
-      @lti_account = LtiAccount.find_by_key(session['oauth_consumer_key']) if session['oauth_consumer_key']
+      @lti_account = LtiAccount.find_by_key(current_session_data['oauth_consumer_key']) if current_session_data['oauth_consumer_key']
 
       !!@client
     rescue Footrest::HttpError::Unauthorized
@@ -129,8 +146,8 @@ module CoalescingPanda
       authorized = false
       if (@lti_account = params['oauth_consumer_key'] && LtiAccount.find_by_key(params['oauth_consumer_key']))
         sanitized_params = sanitize_params
-        authenticator = IMS::LTI::Services::MessageAuthenticator.new(request.original_url, sanitized_params, @lti_account.secret)
-        authorized = authenticator.valid_signature?
+        @tp = IMS::LTI::ToolProvider.new(@lti_account.key, @lti_account.secret, sanitized_params)
+        authorized = @tp.valid_request?(request)
       end
       logger.info 'not authorized on tp valid request' unless authorized
       authorized = authorized && (roles.count == 0 || (roles & lti_roles).count > 0)
@@ -198,7 +215,7 @@ module CoalescingPanda
       if params[:encrypted_session_key]
         return msg_encryptor.decrypt_and_verify(params[:encrypted_session_key])
       end
-      params[:session_key] || session_key_header
+      params[:session_key] || session_key_header || rails_session['persistent_session_key']
     end
 
     def session_key_header

data/lib/coalescing_panda/engine.rb

@@ -1,4 +1,5 @@
 require 'secure_headers'
+require_relative './secure_headers'
 
 module CoalescingPanda
   class Engine < ::Rails::Engine
@@ -42,56 +43,21 @@ module CoalescingPanda
     end
 
     initializer :secure_headers do |app|
-      connect_src = %w('self')
-      script_src = %w('self')
-
-      if Rails.env.development?
-        # Allow webpack-dev-server to work
-        connect_src << "http://localhost:3035"
-        connect_src << "ws://localhost:3035"
-
-        # Allow stuff like rack-mini-profiler to work in development:
-        # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
-        # DON'T ENABLE THIS FOR PRODUCTION!
-        script_src << "'unsafe-eval'"
-      elsif CoalescingPanda.lti_options.has_key?(:allow_unsafe_eval) && CoalescingPanda.lti_options[:allow_unsafe_eval] == true
-        # For when code is returned from server and injected into dom.  Need to have unsafe-eval or it won't work.
-        script_src << "'unsafe-eval'"
-      end
-
-      SecureHeaders::Configuration.default do |config|
-        # The default cookie headers aren't compatible with PandaPal cookies currently
-        config.cookies = { samesite: { none: true } }
-
-        if Rails.env.production?
-          config.cookies[:secure] = true
+      begin
+        ::SecureHeaders::Configuration.default do |config|
+          CoalescingPanda::SecureHeaders.apply_defaults(config)
         end
-
-        # Need to allow LTI iframes
-        config.x_frame_options = "ALLOWALL"
-
-        config.x_content_type_options = "nosniff"
-        config.x_xss_protection = "1; mode=block"
-        config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
-
-        config.csp = {
-            default_src: %w('self'),
-            script_src: script_src,
-            # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
-            style_src: %w('self' 'unsafe-inline' blob: https://fonts.googleapis.com),
-            font_src: %w('self' data: https://fonts.gstatic.com),
-            connect_src: connect_src,
-        }
+      rescue ::SecureHeaders::Configuration::AlreadyConfiguredError
+        # The App already applied settings
       end
 
-      SecureHeaders::Configuration.override(:safari_override) do |config|
+      ::SecureHeaders::Configuration.override(:safari_override) do |config|
         config.cookies = SecureHeaders::OPT_OUT
       end
 
-      SecureHeaders::Configuration.override(:allow_inline_scripts) do |config|
+      ::SecureHeaders::Configuration.override(:allow_inline_scripts) do |config|
         config.csp[:script_src] << "'unsafe-inline'"
       end
     end
-
   end
 end

data/lib/coalescing_panda/misc_helper.rb

@@ -0,0 +1,13 @@
+module CoalescingPanda
+  module MiscHelper
+    MigrationClass = Rails.version < '5.0' ? ActiveRecord::Migration : ActiveRecord::Migration[4.2]
+
+    def self.to_boolean(v)
+      if Rails.version < '5.0'
+        ActiveRecord::Type::Boolean.new.type_cast_from_user("0")
+      else
+        ActiveRecord::Type::Boolean.new.deserialize('0')
+      end
+    end
+  end
+end

data/lib/coalescing_panda/secure_headers.rb

@@ -0,0 +1,84 @@
+module CoalescingPanda
+  module SecureHeaders
+    def self.apply_defaults(config)
+      @config = config
+      # The default cookie headers aren't compatable with CoalescingPanda cookies currenntly
+      config.cookies = { samesite: { none: true } }
+
+      if Rails.env.production?
+        config.cookies[:secure] = true
+      end
+
+      # Need to allow LTI iframes
+      config.x_frame_options = "ALLOWALL"
+
+      config.x_content_type_options = "nosniff"
+      config.x_xss_protection = "1; mode=block"
+      config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
+
+      config.csp ||= {}
+
+      csp_entry(:default_src, %w['self'])
+      csp_entry(:connect_src, %w['self'])
+      csp_entry(:script_src, %w['self'])
+
+      if Rails.env.development?
+        # Allow webpack-dev-server to work
+        csp_entry(:connect_src, "http://localhost:3035")
+        csp_entry(:connect_src, "ws://localhost:3035")
+
+        # Allow stuff like rack-mini-profiler to work in development:
+        # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
+        # DON'T ENABLE THIS FOR PRODUCTION!
+        csp_entry(:script_src, "'unsafe-eval'")
+
+        # Detect and permit Scout APM in Dev
+        if MiscHelper.to_boolean(ENV['SCOUT_DEV_TRACE'])
+          csp_entry(:default_src, 'https://scoutapm.com')
+          csp_entry(:default_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:script_src, "'unsafe-inline'")
+          csp_entry(:script_src, 'https://scoutapm.com')
+          csp_entry(:script_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:connect_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:style_src, 'https://scoutapm.com')
+          csp_entry(:style_src, 'https://apm.scoutapp.com')
+        end
+      end
+
+      if CoalescingPanda.lti_options.has_key?(:allow_unsafe_eval) && CoalescingPanda.lti_options[:allow_unsafe_eval] == true
+        # For when code is returned from server and injected into dom.  Need to have unsafe-eval or it won't work.
+        csp_entry(:script_src, "'unsafe-eval'")
+      end
+
+      # Detect and permit Sentry
+      if defined?(Raven) && Raven.configuration.server.present?
+        csp_entry(:connect_src, Raven.configuration.server)
+
+        # Report CSP Violations to Sentry
+        unless config.csp[:report_uri].present?
+          cfg = Raven.configuration
+          config.csp[:report_uri] = ["#{cfg.scheme}://#{cfg.host}/api/#{cfg.project_id}/security/?sentry_key=#{cfg.public_key}"] unless config.csp[:report_uri].present?
+        end
+      end
+
+      # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
+      csp_entry(:style_src, %w('self' 'unsafe-inline' blob: https://fonts.googleapis.com))
+      csp_entry(:font_src, %w('self' data: https://fonts.gstatic.com))
+
+      @config = nil
+
+      config
+    end
+
+    private
+
+    def self.csp_entry(key, *values)
+      values = values.flatten
+      @config.csp[key] ||= []
+      @config.csp[key] |= values
+    end
+  end
+end

data/lib/coalescing_panda/version.rb

@@ -1,3 +1,3 @@
 module CoalescingPanda
-  VERSION = '5.0.2'
+  VERSION = '5.0.8'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: coalescing_panda
 version: !ruby/object:Gem::Version
-  version: 5.0.2
+  version: 5.0.8
 platform: ruby
 authors:
 - Nathan Mills
@@ -10,20 +10,20 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-07-27 00:00:00.000000000 Z
+date: 2020-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 4.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 4.2.1
 - !ruby/object:Gem::Dependency
@@ -72,16 +72,22 @@ dependencies:
   name: ims-lti
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.2.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.2.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: haml-rails
   requirement: !ruby/object:Gem::Requirement
@@ -423,6 +429,7 @@ files:
 - app/models/coalescing_panda/group.rb
 - app/models/coalescing_panda/group_category.rb
 - app/models/coalescing_panda/group_membership.rb
+- app/models/coalescing_panda/json_with_indifferent_access.rb
 - app/models/coalescing_panda/lti_account.rb
 - app/models/coalescing_panda/lti_nonce.rb
 - app/models/coalescing_panda/oauth_state.rb
@@ -480,7 +487,9 @@ files:
 - lib/coalescing_panda/bearcat_uri.rb
 - lib/coalescing_panda/controller_helpers.rb
 - lib/coalescing_panda/engine.rb
+- lib/coalescing_panda/misc_helper.rb
 - lib/coalescing_panda/route_helpers.rb
+- lib/coalescing_panda/secure_headers.rb
 - lib/coalescing_panda/version.rb
 - lib/tasks/coalescing_panda_tasks.rake
 - spec/controllers/coalescing_panda/canvas_batches_controller_spec.rb