lti_skydrive 1.1.0 → 1.2.0

data/app/controllers/skydrive/application_controller.rb

@@ -45,4 +45,4 @@ module Skydrive
                      ))
     end
   end
-end
+end

data/app/controllers/skydrive/files_controller.rb

@@ -10,10 +10,6 @@ module Skydrive
         head :unauthorized
         return
       end
-
-      if current_user.token && current_user.token.not_before > Time.now
-        current_user.token.refresh!(skydrive_client)
-      end
     end
 
     def index
@@ -56,4 +52,3 @@ module Skydrive
     end
   end
 end
-

data/app/controllers/skydrive/launch_controller.rb

@@ -1,6 +1,14 @@
+require 'raven'
 require 'ims/lti'
 
 module Skydrive
+
+  ERROR_NO_API_KEY = "Unable to get an access token, your state is invalid"
+  ERROR_JSON_PARSE = "JSON::ParserError"
+  ERROR_SKY_DRIVE_API = "Skydrive::APIErrorException"
+
+
+
   class LaunchController < ApplicationController
     include ActionController::Cookies
     before_filter :ensure_authenticated_user, only: :skydrive_authorized
@@ -46,16 +54,26 @@ module Skydrive
         return
       end
 
-      user = @account.users.where(username: tp.user_id).first ||
+      user_id = tp.get_custom_param('masquerading_user_id') || tp.user_id
+      is_masquerading = user_id == tp.get_custom_param('masquerading_user_id')
+      name = is_masquerading ? 'masqueraded session' : tp.lis_person_name_full
+      email = is_masquerading ? 'masqueraded session' : tp.lis_person_contact_email_primary
+
+      user = @account.users.where(username: user_id).first ||
           @account.users.create(
-              lti_user_id: tp.user_id,
-              name: tp.lis_person_name_full,
-              username: tp.user_id,
-              email: tp.lis_person_contact_email_primary,
+              lti_user_id: user_id,
+              name: name,
+              username: user_id,
+              email: email
           )
 
-      user.token = Token.create unless user.token
+      if !is_masquerading && (user.email != email || user.name != name)
+        user.email = email
+        user.name = name
+        user.save!
+      end
 
+      user.ensure_token
       user.cleanup_api_keys
 
       code = user.session_api_key(params).oauth_code
@@ -65,30 +83,40 @@ module Skydrive
     def skydrive_authorized
       skydrive_token = current_user.token
       if skydrive_token && skydrive_token.requires_refresh?
-        skydrive_token.refresh!(skydrive_client)
+        begin
+          skydrive_client.refresh_token = skydrive_token.refresh_token
+          skydrive_token.refresh!(skydrive_client)
+        rescue Skydrive::APIResponseErrorException => error
+          current_user.reset_token!
+        end
       end
 
       if skydrive_token && skydrive_token.is_valid?
         render json: {}, status: 201
       else
         code = current_user.api_keys.active.skydrive_oauth.create.oauth_code
-
         render text: skydrive_client.oauth_authorize_redirect_uri(microsoft_oauth_url, state: code), status: 401
       end
     end
 
     def microsoft_oauth
-      @current_user = ApiKey.trade_oauth_code_for_access_token(params['state']).user
-
-      skydrive_client.request_oauth_token(params['code'], microsoft_oauth_url)
-      service = skydrive_client.get_my_files_service()
-      current_user.token.resource = service["serviceResourceId"]
-      current_user.token.refresh!(skydrive_client)
-
-      personal_url = skydrive_client.get_personal_url(service["serviceEndpointUri"]).gsub(/\/Documents$/,'/')
-      current_user.token.update_attribute(:personal_url, personal_url)
-
-      redirect_to "#{root_path}oauth/callback"
+      begin
+        api_key = ApiKey.trade_oauth_code_for_access_token(params['state'])
+        raise RuntimeError, ERROR_NO_API_KEY unless api_key
+
+        @current_user = api_key.user
+        skydrive_client.request_oauth_token(params['code'], microsoft_oauth_url)
+        service = skydrive_client.get_my_files_service()
+        current_user.token.resource = service["serviceResourceId"]
+        current_user.token.refresh!(skydrive_client)
+
+        personal_url = skydrive_client.get_personal_url(service["serviceEndpointUri"]).gsub(/\/Documents$/,'/')
+        current_user.token.update_attribute(:personal_url, personal_url)
+
+        redirect_to "#{root_path}oauth/callback"
+      rescue Exception => api_error
+        launch_exception_handler api_error
+      end
     end
 
     def xml_config
@@ -107,6 +135,7 @@ module Skydrive
       tc.canvas_homework_submission!
       tc.canvas_account_navigation!
       tc.canvas_course_navigation!(visibility: 'admin')
+      tc.set_custom_param('masquerading_user_id', '$Canvas.masqueradingUser.userId')
       render xml: tc.to_xml
     end
 
@@ -114,5 +143,26 @@ module Skydrive
       render json: {}, status: 200
       current_user.token.destroy
     end
+
+    def launch_error
+      @title = %s{Ooops! Something went terribly wrong!}
+      @message = %s{Not sure what happened, or how you got here?!}
+      render status: 400, layout: "skydrive/error"
+    end
+
+    private
+    def launch_exception_handler(api_error)
+      RavenLogger.capture_exception(api_error)
+      @api_error = api_error
+      @title = %s{Ooops! Something went terribly wrong!}
+      @message = "An error or invalid response was received from the OneDrive API. Close any popups, refresh the page, and relaunch OneDrive."
+
+      if api_error.message == ERROR_NO_API_KEY
+        @title = %s{Unable to retrieve an access token}
+        @message = %s{It looks like your using an old page. Close any popups, and relaunch OneDrive.}
+      end
+
+      render action: :launch_error, status: 400, layout: "skydrive/error"
+    end
   end
 end

data/app/controllers/skydrive/session_controller.rb

@@ -9,4 +9,4 @@ module Skydrive
       end
     end
   end
-end
+end

data/app/models/skydrive/token.rb

@@ -13,13 +13,11 @@ module Skydrive
 
     def refresh!(client)
       results = {}
-
       results = client.refresh_token(resource: resource)
-
       if results.key? 'access_token'
         attrs = ['token_type', 'expires_in', 'expires_on', 'not_before', 'resource', 'access_token', 'refresh_token']
         update_attributes(results.reject{|a| !attrs.include?(a)})
       end
     end
   end
-end
+end

data/app/models/skydrive/user.rb

@@ -24,5 +24,23 @@ module Skydrive
     def valid_skydrive_token?
       !!self.token && self.token.is_valid?
     end
+
+    def ensure_token
+      self.token = self.create_token unless self.token
+    end
+
+    def reset_token!
+      self.token.delete
+      ensure_token
+    end
+
+    # Convenience method
+    def onedrive_client
+      @onedrive_client ||=
+          Client.new(SHAREPOINT.merge(
+                         personal_url: self.token.personal_url,
+                         token: self.token.access_token
+                     ))
+    end
   end
 end

data/app/views/layouts/skydrive/application.html.erb

@@ -21,4 +21,3 @@
 <% end %>
 </body>
 </html>
-

data/app/views/skydrive/launch/app_redirect.html.erb

@@ -1 +1 @@
-<p>result : <%= @result %></p>
+<p>result : <%= @result %></p>

data/app/views/skydrive/launch/launch_error.html.erb

@@ -0,0 +1,4 @@
+<h2><%= @title %></h2>
+<p>
+  <%= @message %>
+</p>

data/config/initializers/sharepoint.rb

@@ -1 +1,2 @@
-SHAREPOINT = YAML.load(File.read("#{Rails.root}/config/sharepoint.yml"))[Rails.env].symbolize_keys
+require 'yaml'
+SHAREPOINT = YAML.load(File.read("#{Rails.root}/config/sharepoint.yml"))[Rails.env].symbolize_keys

data/config/routes.rb

@@ -24,6 +24,7 @@ Skydrive::Engine.routes.draw do
   get 'config' => 'launch#xml_config'
 
   post 'oauth2/token' => 'api_keys#oauth2_token'
+  match 'error' => 'launch#launch_error', :via => [:get, :post]
 
   # forward all other requests to react application
   get '*path', to: 'ember#index'

data/lib/skydrive/client.rb

@@ -3,16 +3,32 @@ require 'curb'
 require 'json'
 require 'mimemagic'
 require 'jwt'
+require 'skydrive/raven_logger'
 
 
 module Skydrive
+  class APIErrorException < RuntimeError
+  end
+
+  class APIResponseErrorException < RuntimeError
+    attr_reader :response, :code, :description
+    def initialize(response)
+      @response = response
+      @code = response['error']
+      @description = response['error_description']
+      super("#{@code}: #{@description}\n#{response}")
+    end
+  end
+
   class Client
     include ActionView::Helpers::NumberHelper
 
     attr_accessor :client_id, :client_secret, :guid, :personal_url, :token, :refresh_token
 
     def initialize(options = {})
-      options.each { |key, val| self.send("#{key}=", val) if self.respond_to?("#{key}=") }
+      options.each do |key, val|
+        self.send("#{key}=", val) if self.respond_to?("#{key}=")
+      end
     end
 
     # URL used to authorize this app for a sharepoint tenant
@@ -42,7 +58,7 @@ module Skydrive
 
       RestClient.post endpoint, options do |response, request, result|
         log_restclient_response(response, request, result)
-        results = format_results(JSON.parse(response))
+        results = format_results(parse_api_response(response))
         self.token = results['access_token']
         self.refresh_token = results['refresh_token']
         results
@@ -69,7 +85,7 @@ module Skydrive
 
       RestClient.post endpoint, options do |response, request, result|
         log_restclient_response(response, request, result)
-        results = format_results(JSON.parse(response))
+        results = format_results(parse_api_response(response))
         self.token = results['access_token']
         self.refresh_token = results['refresh_token']
         results
@@ -123,7 +139,7 @@ module Skydrive
         new_file.content_tag = f['ContentTag']
         folder.files << new_file
       end
-      
+
       sub_folders = api_call(CGI::unescape(data['Folders']['__deferred']['uri']))['results']
       sub_folders.each do |sf|
 
@@ -152,37 +168,49 @@ module Skydrive
     end
 
     def api_call(url, headers = {})
-      url.gsub!("https:/i", "https://i")
-      uri = URI.escape(url)
+      begin
 
-      pid = generate_pid
+        url.gsub!("https:/i", "https://i")
+        uri = URI.escape(url)
 
-      headers['Authorization'] = "Bearer #{token}" unless headers.has_key? 'Authorization'
-      headers['Accept'] = "application/json; odata=verbose" unless headers.has_key? 'Accept'
 
-      c = Curl::Easy.new(uri) do |http|
-        headers.each {|k,v| http.headers[k] = v if v }
-      end
+        headers['Authorization'] = "Bearer #{token}" unless headers.has_key? 'Authorization'
+        headers['Accept'] = "application/json; odata=verbose" unless headers.has_key? 'Accept'
 
-      headers = []
-      buffer = ""
-      c.on_body { |data| 
-        buffer << data
-        data.size
-      }
-      c.on_header { |data|
-        headers << data
-        data.size
-      }
-      c.perform
+        c = Curl::Easy.new(uri) do |http|
+          headers.each {|k,v| http.headers[k] = v if v }
+        end
 
-      Skydrive.logger.info("[#{pid}] SKYDRIVE REQUEST: #{uri.to_s}")
-      headerOutput = c.headers.map {|k,v| "#{k}: #{v}"}.join("\n - ")
-      Skydrive.logger.info("[#{pid}] SKYDRIVE REQUEST HEADERS:\n  - #{headerOutput}")
-      Skydrive.logger.info("[#{pid}] SKYDRIVE RESPONSE HEADERS:\n  - #{headers.join('  - ')}")
-      Skydrive.logger.info("[#{pid}] SKYDRIVE RESPONSE BODY:\n#{buffer}");
+        headers = []
+        buffer = ""
+        c.on_body { |data|
+          buffer << data
+          data.size
+        }
+        c.on_header { |data|
+          headers << data
+          data.size
+        }
+        c.perform
+
+        result = parse_api_response(buffer)
+      rescue Exception => error
+        pid = generate_pid
+        headerOutput = c.headers.map {|k,v| "#{k}: #{v}"}.join("\n[#{pid}] - ")
+        backtrace_output = error.backtrace.join("\n[#{pid}] - ")
+        buffer_output = buffer.split("\n").join("\n[#{pid}] - ")
+
+        Skydrive.logger.error("[#{pid}] SKYDRIVE ERROR: #{error.class.to_s} ◊ #{error}")
+        Skydrive.logger.info("[#{pid}] SKYDRIVE BACKTRACE: \n[#{pid}] - #{backtrace_output}")
+        Skydrive.logger.info("[#{pid}] SKYDRIVE REQUEST: #{uri.to_s}")
+        Skydrive.logger.info("[#{pid}] SKYDRIVE REQUEST HEADERS:\n[#{pid}] - #{headerOutput}")
+        Skydrive.logger.info("[#{pid}] SKYDRIVE RESPONSE HEADERS:\n[#{pid}] - #{headers.join('  - ')}")
+        Skydrive.logger.info("[#{pid}] SKYDRIVE RESPONSE BODY:\n[#{pid}] - #{buffer_output}");
+        Skydrive.logger.info("[#{pid}] END --\n");
+        RavenLogger.capture_exception(error)
+        raise error
+      end
 
-      result = JSON.parse(buffer)
       result["d"] || result
     end
 
@@ -206,5 +234,10 @@ module Skydrive
       (0...8).map { (65 + rand(26)).chr }.join
     end
 
+    def parse_api_response(body)
+      result = JSON.parse(body)
+      raise APIResponseErrorException, result if result["error"]
+      result
+    end
   end
 end

data/lib/skydrive/file.rb

@@ -33,7 +33,7 @@ module Skydrive
         self.kind = mm.comment
         self.suffix = mm.extensions.last
 
-        if allowed_extensions.empty? || (allowed_extensions & mm.extensions).size > 0
+        if allowed_extensions.blank? || (allowed_extensions & mm.extensions).size > 0
           self.is_embeddable = true
         else
           self.is_embeddable = false

data/lib/skydrive/raven_logger.rb

@@ -0,0 +1,16 @@
+require 'raven'
+
+module Skydrive
+  class RavenLogger
+    ENV_KEY = "RAVEN_SKYDRIVE_DSN"
+
+    def self.capture_exception(error)
+      return if Rails.env.test?
+      if (ENV[ENV_KEY])
+        config = Raven.configuration
+        config.dsn = ENV.fetch(ENV_KEY)
+      end
+      Raven.capture_exception(error, {configuration: config})
+    end
+  end
+end

data/lib/skydrive/version.rb

@@ -1,3 +1,3 @@
 module Skydrive
-  VERSION = "1.1.0"
+  VERSION = "1.2.0"
 end

data/spec/controllers/launch_controller_spec.rb

@@ -0,0 +1,209 @@
+require 'spec_helper'
+
+module Skydrive
+  describe LaunchController,  :type => :controller do
+
+    account = Account.find_or_create_by!(key: "one", secret: "not_two" )
+    let(:email) {'user@email.com'}
+    let(:username) {'user'}
+    let(:name) {'User'}
+    let(:sharepoint_client_domain) {'login.windows.net'}
+
+    let(:account) {account}
+    let(:user) {account.users.find_or_initialize_by(email: 'user@email.com', username: 'user', name: 'User')}
+
+    describe '#basic_launch' do
+
+      before(:each) do
+        tp = IMS::LTI::ToolProvider.new(nil, nil, {})
+        tp.lis_person_contact_email_primary = email
+        tp.set_custom_param('sharepoint_client_domain', 'test')
+        tp.user_id = username
+        tp.lis_person_name_full = name
+
+        allow_any_instance_of(LaunchController).to receive(:tool_provider).and_return(tp)
+        controller.instance_variable_set("@account", account)
+      end
+
+      it "creates a new user" do
+        expect(User.where(email: email).count).to be(0)
+
+        post 'basic_launch', use_route: :skydrive
+        expect(response).to be_redirect, response.body
+
+        user = User.where(email: email).first!
+        expect(user.email).to eq(email)
+        expect(user.username).to eq(username)
+        expect(user.name).to eq(name)
+
+        expect(user.token).to be_a Token
+      end
+
+      it "updates existing users' name and email" do
+        user.save
+        tp = IMS::LTI::ToolProvider.new(nil, nil, {})
+        tp.lis_person_contact_email_primary = "updated_email@example.com"
+        tp.set_custom_param('sharepoint_client_domain', 'test')
+        tp.user_id = username
+        tp.lis_person_name_full = "Updated Name"
+        allow_any_instance_of(LaunchController).to receive(:tool_provider).and_return(tp)
+
+        post 'basic_launch', use_route: :skydrive
+        expect(response).to be_redirect, response.body
+
+        user = User.where(username: username).first!
+        expect(user.email).to eq("updated_email@example.com")
+        expect(user.username).to eq(username)
+        expect(user.name).to eq("Updated Name")
+        expect(user.token).to be_a Token
+      end
+
+      it "returns a valid oauth code" do
+        post 'basic_launch', use_route: :skydrive
+
+        code = response.header['Location'].split('/').last
+        api_key = ApiKey.where(oauth_code: code).first!
+      end
+
+      it "find existing users" do
+        user.save
+
+        post 'basic_launch', use_route: :skydrive
+        code = response.header['Location'].split('/').last
+        api_key = ApiKey.where(oauth_code: code).first!
+        expect(api_key.user).to eq(user)
+      end
+
+      it "cleans out expired tokens" do
+        user.save
+        api_key = user.session_api_key
+        api_key.update_attributes(expired_at: Time.now)
+
+        post 'basic_launch', use_route: :skydrive
+
+        expect(ApiKey.where(id: api_key.id).count).to be(0)
+      end
+    end
+
+
+    let(:masquerading_user_id) {'this_is_a_masqueraded_id'}
+    let(:masquerading_email) {'masquerading_user@asd.com'}
+    let(:masquerading_name) { 'Dr. masquerading name'}
+    let(:masquerading_user) {account.users.find_or_initialize_by(email: masquerading_email, username: masquerading_user_id, name: masquerading_name)}
+
+    describe '#basic_launch masqueraded' do
+
+      before(:each) do
+        tp = IMS::LTI::ToolProvider.new(nil, nil, {})
+        tp.lis_person_contact_email_primary = email
+        tp.set_custom_param('sharepoint_client_domain', 'test')
+        tp.set_custom_param('masquerading_user_id', masquerading_user_id)
+        tp.user_id = username
+        tp.lis_person_name_full = name
+
+        allow_any_instance_of(LaunchController).to receive(:tool_provider).and_return(tp)
+        controller.instance_variable_set("@account", account)
+      end
+
+      it "creates a new user with masqueraded user" do
+        expect(User.where(username: masquerading_user_id).count).to be(0)
+
+        post 'basic_launch', use_route: :skydrive
+        expect(response).to be_redirect, response.body
+
+        user = User.where(username: masquerading_user_id).first!
+        expect(user.email).to_not eq(email)
+        expect(user.username).to eq(masquerading_user_id)
+        expect(user.name).to_not eq(name)
+
+        expect(user.token).to be_a Token
+      end
+
+      it "returns a valid oauth code with masqueraded user" do
+        post 'basic_launch', use_route: :skydrive
+
+        code = response.header['Location'].split('/').last
+        api_key = ApiKey.where(oauth_code: code).first!
+      end
+
+      it "find existing users with masqueraded user" do
+        masquerading_user.save
+
+        post 'basic_launch', use_route: :skydrive
+        code = response.header['Location'].split('/').last
+        api_key = ApiKey.where(oauth_code: code).first!
+        expect(api_key.user).to eq(masquerading_user)
+      end
+
+      it "find existing users with masqueraded user" do
+        masquerading_user.save
+
+        post 'basic_launch', use_route: :skydrive
+        code = response.header['Location'].split('/').last
+        api_key = ApiKey.where(oauth_code: code).first!
+
+        user = api_key.user
+        expect(user).to eq(masquerading_user)
+        expect(user.email).to eq(masquerading_email)
+        expect(user.username).to eq(masquerading_user_id)
+        expect(user.name).to eq(masquerading_name)
+      end
+
+
+      it "doesn't update existing users' name and email if they are masquerading" do
+
+        masquerading_user.save
+
+        tp = IMS::LTI::ToolProvider.new(nil, nil, {})
+        tp.lis_person_contact_email_primary = "updated_email@example.com"
+        tp.set_custom_param('sharepoint_client_domain', 'test')
+        tp.user_id = username
+        tp.lis_person_name_full = "Updated Name"
+        allow_any_instance_of(LaunchController).to receive(:tool_provider).and_return(tp)
+
+        post 'basic_launch', use_route: :skydrive
+        expect(response).to be_redirect, response.body
+
+        user = User.where(username: username).first!
+        expect(user.email).to eq("updated_email@example.com")
+        expect(user.username).to eq(username)
+        expect(user.name).to eq("Updated Name")
+        expect(user.token).to be_a Token
+      end
+
+      it "cleans out expired tokens with masqueraded user" do
+        masquerading_user.save
+        api_key = masquerading_user.session_api_key
+        api_key.update_attributes(expired_at: Time.now)
+
+        post 'basic_launch', use_route: :skydrive
+
+        expect(ApiKey.where(id: api_key.id).count).to be(0)
+      end
+    end
+
+    describe '#skydrive_authorized' do
+
+      it "returns a skydrive_auth url when the skydrive token is invalid" do
+        user.save
+        user.token = Token.create()
+
+        allow_any_instance_of(LaunchController).to receive(:current_user).and_return(user)
+
+        post 'skydrive_authorized', use_route: :skydrive
+        expect(response.code).to eq("401")
+        expect(response.body).to include sharepoint_client_domain
+      end
+
+      it "returns a 200 when the skydrive token is valid" do
+        user.save
+        user.token = Token.create(access_token: 'token', expires_on: 1.week.from_now)
+
+        allow_any_instance_of(LaunchController).to receive(:current_user).and_return(user)
+
+        post 'skydrive_authorized', use_route: :skydrive
+        expect(response).to be_success
+      end
+    end
+  end
+end