coalescing_panda 5.0.4 → 5.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0191513dcb57ac4c2146d650ff1b6d03af0cc52ac7aa7f62571b74f018ec3906'
-  data.tar.gz: 1f938c10ebea3510455f6e0f077bb531fc7eca49086df42792ab0ab23f96f6fd
+  metadata.gz: 92bed66c0757318a64fada41a45e598216c1daefdd7b43c8adf0a58c9d5259af
+  data.tar.gz: d99684f401684ffdcb93ae63fe7ea49ba6ae4303db2e68ac43709e934b31ebeb
 SHA512:
-  metadata.gz: 75ffaa346308463f9beb170800fafa30a6303613a52e8c7ce527efee418369e0ae4a94ef7f2dbb1ef12b5a5f8a7d43ef33b59114064ee4eb63fca72cc3843305
-  data.tar.gz: bb268446450390d6af368149529ca6f23e34596155dc2151fcf5ee8cc2d604d25eb575cee4627b039894a8f8f439a52f6c8e959f4b8e0ff53979fe56128c1240
+  metadata.gz: 8d1289c6a483a650b1e54a669ad2968cd1d3935e4ef3a67de130775cacfeab78a810ab7a736edb7b5a63b1960633f98fb8d813ceb0e3b6dd1e59d50448fa9697
+  data.tar.gz: a8b9d22ffc7262a1385e156915e382ef43bc0d3e68d9077032676c92b9e9dd466084289c143079e977ee20d82e7259a05496ed452798aaf3ae3306f9efe006b7

data/db/migrate/20131114150001_create_coalescing_panda_canvas_api_auths.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCanvasApiAuths < ActiveRecord::Migration
+class CreateCoalescingPandaCanvasApiAuths < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_canvas_api_auths do |t|
       t.string :user_id

data/db/migrate/20131118211442_create_coalescing_panda_lti_accounts.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaLtiAccounts < ActiveRecord::Migration
+class CreateCoalescingPandaLtiAccounts < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_lti_accounts do |t|
       t.string :name

data/db/migrate/20131119165343_create_coalescing_panda_lti_nonces.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaLtiNonces < ActiveRecord::Migration
+class CreateCoalescingPandaLtiNonces < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_lti_nonces do |t|
       t.belongs_to :coalescing_panda_lti_account

data/db/migrate/20140904223159_create_coalescing_panda_sessions.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSessions < ActiveRecord::Migration
+class CreateCoalescingPandaSessions < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_sessions do |t|
       t.string :token

data/db/migrate/20141119225319_create_coalescing_panda_terms.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaTerms < ActiveRecord::Migration
+class CreateCoalescingPandaTerms < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_terms do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141119225721_create_coalescing_panda_courses.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCourses < ActiveRecord::Migration
+class CreateCoalescingPandaCourses < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_courses do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141120151432_create_coalescing_panda_sections.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSections < ActiveRecord::Migration
+class CreateCoalescingPandaSections < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_sections do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20141120151940_create_coalescing_panda_assignments.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaAssignments < ActiveRecord::Migration
+class CreateCoalescingPandaAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_assignments do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20141120152458_create_coalescing_panda_users.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaUsers < ActiveRecord::Migration
+class CreateCoalescingPandaUsers < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_users do |t|
       t.belongs_to :coalescing_panda_lti_account, null: false

data/db/migrate/20141120152546_create_coalescing_panda_submissions.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaSubmissions < ActiveRecord::Migration
+class CreateCoalescingPandaSubmissions < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_submissions do |t|
       t.belongs_to :coalescing_panda_user, null: false

data/db/migrate/20141120153135_create_coalescing_panda_enrollments.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaEnrollments < ActiveRecord::Migration
+class CreateCoalescingPandaEnrollments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_enrollments do |t|
       t.belongs_to :coalescing_panda_user, null: false

data/db/migrate/20141121174846_create_coalescing_panda_canvas_batches.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaCanvasBatches < ActiveRecord::Migration
+class CreateCoalescingPandaCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_canvas_batches do |t|
       t.float :percent_complete, default: 0.0

data/db/migrate/20141124160857_create_delayed_jobs.rb

@@ -1,4 +1,4 @@
-class CreateDelayedJobs < ActiveRecord::Migration
+class CreateDelayedJobs < CoalescingPanda::MiscHelper::MigrationClass
   def self.up
     create_table :delayed_jobs, :force => true do |table|
       table.integer :priority, :default => 0, :null => false # Allows some jobs to jump to the front of the queue

data/db/migrate/20141208221740_add_submission_types_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddSubmissionTypesToAssignments < ActiveRecord::Migration
+class AddSubmissionTypesToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :submission_types, :text
   end

data/db/migrate/20150106175418_add_group_category_id_to_assignment.rb

@@ -1,4 +1,4 @@
-class AddGroupCategoryIdToAssignment < ActiveRecord::Migration
+class AddGroupCategoryIdToAssignment < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :group_category_id, :integer
     add_column :coalescing_panda_assignments, :grade_group_students_individually, :boolean

data/db/migrate/20150106180131_add_published_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddPublishedToAssignments < ActiveRecord::Migration
+class AddPublishedToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :published, :boolean
   end

data/db/migrate/20150107205405_create_coalescing_panda_groups.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroups < ActiveRecord::Migration
+class CreateCoalescingPandaGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_groups do |t|
       t.belongs_to :context, polymorphic: true

data/db/migrate/20150107205413_create_coalescing_panda_group_memberships.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroupMemberships < ActiveRecord::Migration
+class CreateCoalescingPandaGroupMemberships < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_group_memberships do |t|
       t.belongs_to :coalescing_panda_group

data/db/migrate/20150210180516_add_context_to_canvas_batch.rb

@@ -1,4 +1,4 @@
-class AddContextToCanvasBatch < ActiveRecord::Migration
+class AddContextToCanvasBatch < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :context_id, :integer
     add_column :coalescing_panda_canvas_batches, :context_type, :string

data/db/migrate/20150506183335_create_coalescing_panda_assignment_groups.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaAssignmentGroups < ActiveRecord::Migration
+class CreateCoalescingPandaAssignmentGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_assignment_groups do |t|
       t.belongs_to :coalescing_panda_course, null: false

data/db/migrate/20150506192717_add_assignment_group_id_to_assignments.rb

@@ -1,4 +1,4 @@
-class AddAssignmentGroupIdToAssignments < ActiveRecord::Migration
+class AddAssignmentGroupIdToAssignments < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_assignments, :coalescing_panda_assignment_group_id, :integer
   end

data/db/migrate/20150526144713_add_account_to_canvas_batches.rb

@@ -1,4 +1,4 @@
-class AddAccountToCanvasBatches < ActiveRecord::Migration
+class AddAccountToCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :coalescing_panda_lti_account_id, :integer, index: true
   end

data/db/migrate/20150602205257_add_option_to_canvas_batches.rb

@@ -1,4 +1,4 @@
-class AddOptionToCanvasBatches < ActiveRecord::Migration
+class AddOptionToCanvasBatches < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_batches, :options, :text
   end

data/db/migrate/20150708192717_add_group_moderator_to_group_memberships.rb

@@ -1,4 +1,4 @@
-class AddGroupModeratorToGroupMemberships < ActiveRecord::Migration
+class AddGroupModeratorToGroupMemberships < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_group_memberships, :moderator, :boolean
   end

data/db/migrate/20150709192717_add_leader_id_to_groups.rb

@@ -1,4 +1,4 @@
-class AddLeaderIdToGroups < ActiveRecord::Migration
+class AddLeaderIdToGroups < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_groups, :leader_id, :integer
     add_foreign_key :coalescing_panda_groups, :coalescing_panda_users, column: :leader_id, primary_key: "id"

data/db/migrate/20150714205405_create_coalescing_panda_group_categories.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaGroupCategories < ActiveRecord::Migration
+class CreateCoalescingPandaGroupCategories < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_group_categories do |t|
       t.belongs_to :context, polymorphic: true

data/db/migrate/20150811140030_add_fields_to_users.rb

@@ -1,4 +1,4 @@
-class AddFieldsToUsers < ActiveRecord::Migration
+class AddFieldsToUsers < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_users, :login_id, :string
   end

data/db/migrate/20151209155923_add_refresh_settings_to_canvas_api_auth.rb

@@ -1,4 +1,4 @@
-class AddRefreshSettingsToCanvasApiAuth < ActiveRecord::Migration
+class AddRefreshSettingsToCanvasApiAuth < CoalescingPanda::MiscHelper::MigrationClass
   def change
     add_column :coalescing_panda_canvas_api_auths, :refresh_token, :string
     add_column :coalescing_panda_canvas_api_auths, :expires_at, :datetime

data/db/migrate/20160830183155_create_coalescing_panda_oauth_states.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaOauthStates < ActiveRecord::Migration
+class CreateCoalescingPandaOauthStates < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_oauth_states do |t|
       t.string :state_key

data/db/migrate/20200528224505_create_coalescing_panda_persistent_session.rb

@@ -1,4 +1,4 @@
-class CreateCoalescingPandaPersistentSession < ActiveRecord::Migration
+class CreateCoalescingPandaPersistentSession < CoalescingPanda::MiscHelper::MigrationClass
   def change
     create_table :coalescing_panda_persistent_sessions do |t|
       t.string :session_key

data/lib/coalescing_panda/engine.rb

@@ -1,4 +1,5 @@
 require 'secure_headers'
+require_relative './secure_headers'
 
 module CoalescingPanda
   class Engine < ::Rails::Engine
@@ -42,56 +43,21 @@ module CoalescingPanda
     end
 
     initializer :secure_headers do |app|
-      connect_src = %w('self')
-      script_src = %w('self')
-
-      if Rails.env.development?
-        # Allow webpack-dev-server to work
-        connect_src << "http://localhost:3035"
-        connect_src << "ws://localhost:3035"
-
-        # Allow stuff like rack-mini-profiler to work in development:
-        # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
-        # DON'T ENABLE THIS FOR PRODUCTION!
-        script_src << "'unsafe-eval'"
-      elsif CoalescingPanda.lti_options.has_key?(:allow_unsafe_eval) && CoalescingPanda.lti_options[:allow_unsafe_eval] == true
-        # For when code is returned from server and injected into dom.  Need to have unsafe-eval or it won't work.
-        script_src << "'unsafe-eval'"
-      end
-
-      SecureHeaders::Configuration.default do |config|
-        # The default cookie headers aren't compatible with PandaPal cookies currently
-        config.cookies = { samesite: { none: true } }
-
-        if Rails.env.production?
-          config.cookies[:secure] = true
+      begin
+        ::SecureHeaders::Configuration.default do |config|
+          CoalescingPanda::SecureHeaders.apply_defaults(config)
         end
-
-        # Need to allow LTI iframes
-        config.x_frame_options = "ALLOWALL"
-
-        config.x_content_type_options = "nosniff"
-        config.x_xss_protection = "1; mode=block"
-        config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
-
-        config.csp = {
-            default_src: %w('self'),
-            script_src: script_src,
-            # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
-            style_src: %w('self' 'unsafe-inline' blob: https://fonts.googleapis.com),
-            font_src: %w('self' data: https://fonts.gstatic.com),
-            connect_src: connect_src,
-        }
+      rescue ::SecureHeaders::Configuration::AlreadyConfiguredError
+        # The App already applied settings
       end
 
-      SecureHeaders::Configuration.override(:safari_override) do |config|
+      ::SecureHeaders::Configuration.override(:safari_override) do |config|
         config.cookies = SecureHeaders::OPT_OUT
       end
 
-      SecureHeaders::Configuration.override(:allow_inline_scripts) do |config|
+      ::SecureHeaders::Configuration.override(:allow_inline_scripts) do |config|
         config.csp[:script_src] << "'unsafe-inline'"
       end
     end
-
   end
 end

data/lib/coalescing_panda/misc_helper.rb

@@ -0,0 +1,13 @@
+module CoalescingPanda
+  module MiscHelper
+    MigrationClass = Rails.version < '5.0' ? ActiveRecord::Migration : ActiveRecord::Migration[4.2]
+
+    def self.to_boolean(v)
+      if Rails.version < '5.0'
+        ActiveRecord::Type::Boolean.new.type_cast_from_user("0")
+      else
+        ActiveRecord::Type::Boolean.new.deserialize('0')
+      end
+    end
+  end
+end

data/lib/coalescing_panda/secure_headers.rb

@@ -0,0 +1,84 @@
+module CoalescingPanda
+  module SecureHeaders
+    def self.apply_defaults(config)
+      @config = config
+      # The default cookie headers aren't compatable with CoalescingPanda cookies currenntly
+      config.cookies = { samesite: { none: true } }
+
+      if Rails.env.production?
+        config.cookies[:secure] = true
+      end
+
+      # Need to allow LTI iframes
+      config.x_frame_options = "ALLOWALL"
+
+      config.x_content_type_options = "nosniff"
+      config.x_xss_protection = "1; mode=block"
+      config.referrer_policy = %w(origin-when-cross-origin strict-origin-when-cross-origin)
+
+      config.csp ||= {}
+
+      csp_entry(:default_src, %w['self'])
+      csp_entry(:connect_src, %w['self'])
+      csp_entry(:script_src, %w['self'])
+
+      if Rails.env.development?
+        # Allow webpack-dev-server to work
+        csp_entry(:connect_src, "http://localhost:3035")
+        csp_entry(:connect_src, "ws://localhost:3035")
+
+        # Allow stuff like rack-mini-profiler to work in development:
+        # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
+        # DON'T ENABLE THIS FOR PRODUCTION!
+        csp_entry(:script_src, "'unsafe-eval'")
+
+        # Detect and permit Scout APM in Dev
+        if MiscHelper.to_boolean(ENV['SCOUT_DEV_TRACE'])
+          csp_entry(:default_src, 'https://scoutapm.com')
+          csp_entry(:default_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:script_src, "'unsafe-inline'")
+          csp_entry(:script_src, 'https://scoutapm.com')
+          csp_entry(:script_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:connect_src, 'https://apm.scoutapp.com')
+
+          csp_entry(:style_src, 'https://scoutapm.com')
+          csp_entry(:style_src, 'https://apm.scoutapp.com')
+        end
+      end
+
+      if CoalescingPanda.lti_options.has_key?(:allow_unsafe_eval) && CoalescingPanda.lti_options[:allow_unsafe_eval] == true
+        # For when code is returned from server and injected into dom.  Need to have unsafe-eval or it won't work.
+        csp_entry(:script_src, "'unsafe-eval'")
+      end
+
+      # Detect and permit Sentry
+      if defined?(Raven) && Raven.configuration.server.present?
+        csp_entry(:connect_src, Raven.configuration.server)
+
+        # Report CSP Violations to Sentry
+        unless config.csp[:report_uri].present?
+          cfg = Raven.configuration
+          config.csp[:report_uri] = ["#{cfg.scheme}://#{cfg.host}/api/#{cfg.project_id}/security/?sentry_key=#{cfg.public_key}"] unless config.csp[:report_uri].present?
+        end
+      end
+
+      # Certain CSS-in-JS libraries inline the CSS, so we need to use unsafe-inline for them
+      csp_entry(:style_src, %w('self' 'unsafe-inline' blob: https://fonts.googleapis.com))
+      csp_entry(:font_src, %w('self' data: https://fonts.gstatic.com))
+
+      @config = nil
+
+      config
+    end
+
+    private
+
+    def self.csp_entry(key, *values)
+      values = values.flatten
+      @config.csp[key] ||= []
+      @config.csp[key] |= values
+    end
+  end
+end

data/lib/coalescing_panda/version.rb

@@ -1,3 +1,3 @@
 module CoalescingPanda
-  VERSION = '5.0.4'
+  VERSION = '5.0.6'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: coalescing_panda
 version: !ruby/object:Gem::Version
-  version: 5.0.4
+  version: 5.0.6
 platform: ruby
 authors:
 - Nathan Mills
@@ -10,20 +10,20 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-07-29 00:00:00.000000000 Z
+date: 2020-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 4.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 4.2.1
 - !ruby/object:Gem::Dependency
@@ -487,7 +487,9 @@ files:
 - lib/coalescing_panda/bearcat_uri.rb
 - lib/coalescing_panda/controller_helpers.rb
 - lib/coalescing_panda/engine.rb
+- lib/coalescing_panda/misc_helper.rb
 - lib/coalescing_panda/route_helpers.rb
+- lib/coalescing_panda/secure_headers.rb
 - lib/coalescing_panda/version.rb
 - lib/tasks/coalescing_panda_tasks.rake
 - spec/controllers/coalescing_panda/canvas_batches_controller_spec.rb