panda_pal 4.1.0.beta3 → 5.0.0.beta.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: ef5b128c1f14031f45d4955e56094db8cab358ba
-  data.tar.gz: 0e55cffec0dc1dd61ce847d018f1140a047549ab
+SHA256:
+  metadata.gz: 417de10d63af26bbeadb9b1fa5d57f74fad8070dec477ecf42f7ba914c46be4e
+  data.tar.gz: '0268833a242fda47935ec01207644c3a74daaa31b37b311401ac216b9e34f9bf'
 SHA512:
-  metadata.gz: db77dbe724b48bad8a1439e6296c48f1063cb90b22c9bf22a96f7e351cd5c6cbe186b1abe847983e35f3417bba4f1d4d9ce849f0628e158873a4db46d515b20f
-  data.tar.gz: a9257806e5ad3c1d24b5faf0b0ca030ed7819b2ddd4aa3f8c20f80da103a1f95fb08a0bda9fe714b4cda4da2b678c46ff2ed4a176e730e7627fc4ad2f4e2dc13
+  metadata.gz: 1093764dca3b51778eb98cf8c8ce64bc88af73fb970e9f61597c3f71c92761729ad636ea156da7f2aad7d656ca2f35311f4cce72a338c3eb49f8cb85b788f229
+  data.tar.gz: ee960dc3a06b1da790af9ce3f9a7e6bb76bb06e75a2645097654833226ed84f1f9655455c396607b74981879bed44029147b55ead6efc6437b4abe1c9feb4699

data/README.md

@@ -28,38 +28,6 @@ Use one of these 6 options in `PandaPal.lti_options` hash.
 5. Leave this property off, and you will get the dynamic host with the root path ('http://appdomain.com/') by default.
 6. If you really do not want this property use the option `launch_url: false` for it to be left off.
 
-### Task Scheduling
-`PandaPal` includes an integration with `sidekiq-scheduler`. You can define tasks on an Organization class Stub like so:
-```ruby
-# <your_app>/app/models/organization.rb
-module PandaPal
-  class Organization
-    # Will invoke CanvasSyncStarterWorker.perform_async() according to the cron schedule
-    scheduled_task '0 15 05 * * *', :identifier, worker: CanvasSyncStarterWorker
-
-    # Will invoke the method 'organization_method' on the Organization
-    scheduled_task '0 15 05 * * *', :organization_method_and_identifier
-
-    # If you need to invoke the same method on multiple schedules
-    scheduled_task '0 15 05 * * *', :identifier, worker: :organization_method
-
-    # You can also use a block
-    scheduled_task '0 15 05 * * *', :identifier do
-      # Do Stuff
-    end
-
-    # You can use a Proc (called in the context of the Organization) to determine the schedule
-    scheduled_task -> { settings[:cron] }, :identifier
-
-    # You can specify a timezone. If a TZ is not coded and settings[:timezone] is present, it will be appended automatically
-    scheduled_task '0 15 05 * * * America/Denver', :identifier, worker: :organization_method
-
-    # Setting settings[:task_schedules][:identifier] will override the code cron schedule. Setting it to false will disable the Task
-    # :identifer values _must_ be unique, but can be nil, in which case they will be determined by where (lineno etc) scheduled_task is called
-  end
-end
-```
-
 # Organization Attributes
   id: Primary Key
   name: Name of the organization. Used to on requests to select the tenant
@@ -258,43 +226,9 @@ In your panda_pal initializer (i.e. config/initializers/panda_pal.rb or config/i
 You can specify options that can include a structure for your settings.  If specified, PandaPal will
 enforce this structure on any new / updated organizations.
 
-```ruby
-PandaPal.lti_options = {
-  title: 'LBS Gradebook',
-  settings_structure: {
-    allow_additional: true, # Allow additional properties that aren't included in the :properties Hash.
-    allow_additional: { type: 'String' }, # You can also set :allow_additional to a settings specification that will be used to validate each additional setting
-    validate: ->(value, spec, **kwargs) {
-      # kwargs currently includes:
-      #   :errors => [An array to push errors to]
-      #   :path => [An array representation of the current path in the settings object]
-
-      # To add errors, you may:
-      # Push strings to the kwargs[:errors] Array:
-      kwargs[:errors] << "Your error message at <path>" unless value < 10
-      # Or return a string or string array:
-      value.valid? ? nil : "Your error message at <path>" # <path> will be replaced with the actual path that the error occurred at
-    },
-    properties: {
-      canvas_api_token: { type: 'String', required: true, },
-      catalog: { # :validate, :allow_additional, :properties keys are all supported at this level as well
-        type: 'Hash',
-        required: false,
-        validate: -> (*args) {},
-        allow_additional: false,
-        properties: {
-
-        },
-      }
-    }
-  },
-}
-```
-
-#### Legacy Settings Structure:
 Here is an example options specification:
 
-```ruby
+```
 PandaPal.lti_options = {
   title: 'LBS Gradebook',
   settings_structure: YAML.load("
@@ -347,7 +281,83 @@ Safari is weird, and you'll potentially run into issues getting `POST` requests
 
 This will allow `PandaPal` to apply an iframe cookie fix that will allow CSRF validation to work.
 
-## Running Specs:
-Initialize the Specs DB:
-`cd spec/dummy; bundle exec rake db:drop; bundle exec rake db:create; bundle exec rake db:schema:load`
-Then `bundle exec rspec`
+
+### PandaPal 5
+
+It has been a constant struggle to force safari to store and allow
+access to a rails session while the application is embedded in Canvas.
+
+As of PandaPal 5, a forced persistent session is now optional, and defaults to off.
+
+This means that safari will likely refuse to send info about your rails session
+back to the LTI, and the application will start up a new session each time the
+browser navigates.  This likely means a new session each time the LTI launches.
+
+You will want to watch out for a few scenarios:
+
+1) Make sure you are using "redirect_with_session_to" if you need to redirect
+   and have your PandaPal session_key persisted server side.
+2) Use the "Authorization" header with "token={session_key}" to send your
+   PandaPal session info into api calls.
+
+You can force a persistent session with -
+PandaPal.lti_options = {
+  require_persistent_session: true
+}
+in your config/initializer.  With that setting, the user will be required to
+allow our application to store / access cookies in safari before they can use
+the LTI.
+
+# Notes on require_persistent_session
+
+IF you must have a persistent session this is the logical flow of how panda_pal
+attempts to set that up.
+
+1) LTI laumches.
+2) LTI will attempt to POST message from iframe to top window (canvas) telling
+   canvas to relaunch in full screen so we aren't inhibited by safari.
+3) LTI will setup session and cookies in full-screen mode.  Session will be saved
+   in browser.
+4) LTI will redirect to an authorization page, that will require user to give
+   access to the session store to our application.
+5) Once the user gives access to the session store, we will reload the LTI
+   and the cookie should now be persistent.
+
+# Upgrading from PandaPal 4 to 5:
+
+If your tool is setup according to a pretty standard pattern (see pace_plans,
+canvas_group_enrollment, etc), you shouldn't have to do anything to upgrade.
+
+You will want to make sure that IF your launch controller is redirecting, it is
+using "redirect_with_session_to".
+
+Here is an example launch / account controller setup, assuming an account launch.
+
+```
+class LaunchController < ApplicationController
+  # We don't verify CSRF on launch because the LTI launch is done via a POST
+  # request, and Canvas wouldn't know anything about the CSRF
+  skip_before_action :verify_authenticity_token
+  skip_before_action :forbid_access_if_lacking_session # We don't have a session yet
+  around_action :switch_tenant
+  before_action :validate_launch!
+  before_action :handle_launch
+
+  def handle_launch
+    current_session_data[:canvas_user_id] = params[:custom_canvas_user_id]
+    current_session_data[:canvas_course_id] = params[:custom_canvas_course_id]
+  end
+
+  def account
+    redirect_with_session_to :accounts_url
+  end
+end
+
+class AccountController < ApplicationController
+  prepend_before_action :forbid_access_if_lacking_session
+
+  def index
+  end
+end
+```
+

data/app/models/panda_pal/organization.rb

@@ -1,23 +1,15 @@
-Dir[File.dirname(__FILE__) + "/organization/*.rb"].each { |file| require file }
-
 module PandaPal
-  module OrganizationConcerns; end
 
   class Organization < ActiveRecord::Base
-    include OrganizationConcerns::SettingsValidation
-    include OrganizationConcerns::TaskScheduling if defined?(Sidekiq.schedule)
-
     attribute :settings
-    serialize :settings, Hash
     attr_encrypted :settings, marshal: true, key: :encryption_key
     before_save {|a| a.settings = a.settings} # this is a hacky work-around to a bug where attr_encrypted is not saving settings in place
-
     validates :key, uniqueness: { case_sensitive: false }, presence: true
     validates :secret, presence: true
     validates :name, uniqueness: { case_sensitive: false }, presence: true, format: { with: /\A[a-z0-9_]+\z/i }
     validates :canvas_account_id, presence: true
     validates :salesforce_id, presence: true, uniqueness: true
-
+    validate :validate_settings
     after_create :create_schema
     after_commit :destroy_schema, on: :destroy
 
@@ -25,6 +17,8 @@ module PandaPal
       errors.add(:name, 'should not be changed after creation') if name_changed?
     end
 
+    serialize :settings, Hash
+
     def encryption_key
       # production environment might not have loaded secret_key_base yet.
       # In that case, just read it from env.
@@ -35,14 +29,6 @@ module PandaPal
       end
     end
 
-    def switch_tenant(&block)
-      if block_given?
-        Apartment::Tenant.switch(name, &block)
-      else
-        Apartment::Tenant.switch!(name)
-      end
-    end
-
     private
 
     def create_schema
@@ -52,5 +38,48 @@ module PandaPal
     def destroy_schema
       Apartment::Tenant.drop name
     end
+
+    def validate_settings
+      record = self
+      if PandaPal.lti_options && PandaPal.lti_options[:settings_structure]
+        validate_level(record, PandaPal.lti_options[:settings_structure], record.settings, [])
+      end
+    end
+    def validate_level(record, expectation, reality, previous_keys)
+      # Verify that the data elements at this level conform to requirements.
+      if expectation
+        expectation.each do |key, value|
+          is_required = expectation[key].try(:delete, :is_required)
+          data_type = expectation[key].try(:delete, :data_type)
+          value = reality.is_a?(Hash) ? reality.dig(key) : reality
+
+          if is_required && !value
+            record.errors[:settings] << "PandaPal::Organization.settings requires key [:#{previous_keys.push(key).join("][:")}].  It was not found."
+          end
+          if data_type && value
+            if value.class.to_s != data_type
+              record.errors[:settings] << "PandaPal::Organization.settings expected key [:#{previous_keys.push(key).join("][:")}] to be #{data_type} but it was instead #{value.class}."
+            end
+          end
+        end
+      end
+      # Verify that anything that is in the real settings has an expectation.
+      if reality
+        if reality.is_a? Hash
+          reality.each do |key, value|
+            was_expected = expectation.has_key?(key)
+            if !was_expected
+              record.errors[:settings] << "PandaPal::Organization.settings had unexpected key: #{key}.  If settings have expanded please update your lti_options accordingly."
+            end
+          end
+        end
+      end
+      # Recursively check out any children settings as well.
+      if expectation
+        expectation.each do |key, value|
+          validate_level(record, expectation[key], (reality.is_a?(Hash) ? reality.dig(key) : nil), previous_keys.deep_dup.push(key))
+        end
+      end
+    end
   end
 end

data/app/views/panda_pal/lti/iframe_cookie_authorize.html.erb

@@ -0,0 +1,19 @@
+<html>
+  <p>Safari requires your consent to access session information when applications are hosted inside of Canvas.  Please consent by clicking the following button.</p>
+  <button id="myButton">Authorize application to use browser session</button>
+  <script nonce=<%= content_security_policy_script_nonce %>>
+    function makeRequestWithUserGesture() {
+      var promise = document.requestStorageAccess();
+      promise.then(
+        function () {
+          var referrer = document.referrer;
+          window.location='?safari_cookie_authorized=true&return_to='.concat(encodeURI(window.location));
+        },
+        function () {
+          // If the user doesn't consent, then do nothing.
+        }
+      );
+    }
+    document.getElementById("myButton").addEventListener("click", makeRequestWithUserGesture);
+  </script>
+</html>

data/lib/panda_pal/helpers/controller_helper.rb

@@ -42,20 +42,29 @@ module PandaPal::Helpers::ControllerHelper
       render plain: 'Invalid Credentials, please contact your Administrator.', :status => :unauthorized unless authorized
       return authorized
     end
-    if cookies_need_iframe_fix?
-      fix_iframe_cookies
-      return false
-    end
-    # For safari we may have been launched temporarily full-screen by canvas.  This allows us to set the session cookie.
-    # In this case, we should make sure the session cookie is fixed and redirect back to canvas to properly launch the embedded LTI.
-    if params[:platform_redirect_url]
-      session[:safari_cookie_fixed] = true
-      redirect_to params[:platform_redirect_url]
-      return false
+    if require_persistent_session
+      if cookies_need_iframe_fix?(false)
+        fix_iframe_cookies
+        return false
+      end
+      # For safari we may have been launched temporarily full-screen by canvas.  This allows us to set the session cookie.
+      # In this case, we should make sure the session cookie is fixed and redirect back to canvas to properly launch the embedded LTI.
+      if params[:platform_redirect_url]
+        session[:safari_cookie_fixed] = true
+        redirect_to params[:platform_redirect_url]
+        return false
+      end
     end
     return authorized
   end
 
+  def require_persistent_session
+    if PandaPal.lti_options.has_key?(:require_persistent_session) && PandaPal.lti_options[:require_persistent_session] == true
+      return true
+    end
+    return false
+  end
+
   def switch_tenant(organization = current_organization, &block)
     return unless organization
     raise 'This method should be called in an around_action callback' unless block_given?
@@ -70,20 +79,26 @@ module PandaPal::Helpers::ControllerHelper
   # redirect the current page to the LTI using JavaScript, which will set the cookie,
   # and then immediately redirect back to Canvas.
   def fix_iframe_cookies
-    if params[:safari_cookie_fix].present?
-      session[:safari_cookie_fixed] = true
+    if params[:safari_cookie_authorized].present?
+      session[:safari_cookie_authorized] = true
       redirect_to params[:return_to]
+    elsif (session[:safari_cookie_fixed] && !params[:safari_cookie_authorized])
+      render 'panda_pal/lti/iframe_cookie_authorize', layout: false
     else
       render 'panda_pal/lti/iframe_cookie_fix', layout: false
     end
   end
 
-  def cookies_need_iframe_fix?
-    browser.safari? && !request.referrer&.include?('sessionless_launch') && !session[:safari_cookie_fixed] && !params[:platform_redirect_url]
+  def cookies_need_iframe_fix?(check_authorized=true)
+    if check_authorized
+      return browser.safari? && !request.referrer&.include?('sessionless_launch') && !(session[:safari_cookie_fixed] && session[:safari_cookie_authorized]) && !params[:platform_redirect_url]
+    else
+      return browser.safari? && !request.referrer&.include?('sessionless_launch') && !session[:safari_cookie_fixed] && !params[:platform_redirect_url]
+    end
   end
 
   def forbid_access_if_lacking_session
-    if cookies_need_iframe_fix?
+    if require_persistent_session && cookies_need_iframe_fix?(true)
       fix_iframe_cookies
     else
       render plain: 'You should do an LTI Tool Launch.', status: :unauthorized unless valid_session?
@@ -122,4 +137,34 @@ module PandaPal::Helpers::ControllerHelper
       match[1]
     end
   end
+
+  # Redirect with the session key intact. In production,
+  # handle this by saving it to the flash. In dev,
+  # just put it in the URL. Putting it in the URL
+  # is insecure, but is fine in development.
+  # Keeping it in the URL in development means that it plays
+  # nicely with webpack-dev-server live reloading (otherwise
+  # you get an access error everytime it tries to live reload).
+
+  def redirect_with_session_to(location, params = {})
+    if Rails.env.development?
+      redirect_development_mode(location, params)
+    else
+      redirect_production_mode(location, params)
+    end
+  end
+
+  def redirect_development_mode(location, params)
+    redirect_to send(location, {
+      session_key: current_session.session_key,
+      organization_id: current_organization.id
+    }.merge(params))
+  end
+
+  def redirect_production_mode(location, params)
+    flash['session_key'] = current_session.session_key
+    redirect_to send(location, {
+      organization_id: current_organization.id
+    }.merge(params))
+  end
 end

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "4.1.0.beta3"
+  VERSION = "5.0.0.beta.1"
 end

data/panda_pal.gemspec

@@ -22,9 +22,6 @@ Gem::Specification.new do |s|
   s.add_dependency 'browser', '2.5.0'
   s.add_dependency 'attr_encrypted', '~> 3.0.0'
   s.add_dependency 'secure_headers', '~> 6.1.2'
-
-  s.add_development_dependency 'sidekiq'
-  s.add_development_dependency 'sidekiq-scheduler'
   s.add_development_dependency 'rspec-rails'
   s.add_development_dependency 'factory_girl_rails'
 end

data/spec/dummy/config/application.rb

@@ -1,12 +1,6 @@
 require File.expand_path('../boot', __FILE__)
 
-require "active_model/railtie"
-require "active_job/railtie"
-require "active_record/railtie"
-# require "active_storage/engine"
-require "action_controller/railtie"
-require "action_mailer/railtie"
-require "action_view/railtie"
+require 'rails/all'
 
 Bundler.require(*Rails.groups)
 require "panda_pal"

data/spec/dummy/config/environments/development.rb

@@ -22,6 +22,20 @@ Rails.application.configure do
   # Raise an error on page load if there are pending migrations.
   config.active_record.migration_error = :page_load
 
+  # Debug mode disables concatenation and preprocessing of assets.
+  # This option may cause significant delays in view rendering with a large
+  # number of complex assets.
+  config.assets.debug = true
+
+  # Asset digests allow you to set far-future HTTP expiration dates on all assets,
+  # yet still be able to expire them through the digest params.
+  config.assets.digest = true
+
+  # Adds additional error checking when serving assets at runtime.
+  # Checks for improperly declared sprockets dependencies.
+  # Raises helpful error messages.
+  config.assets.raise_runtime_errors = true
+
   # Raises error for missing translations
   # config.action_view.raise_on_missing_translations = true
 end

data/spec/dummy/config/environments/production.rb

@@ -24,6 +24,17 @@ Rails.application.configure do
   # Apache or NGINX already handles this.
   config.serve_static_files = ENV['RAILS_SERVE_STATIC_FILES'].present?
 
+  # Compress JavaScripts and CSS.
+  config.assets.js_compressor = :uglifier
+  # config.assets.css_compressor = :sass
+
+  # Do not fallback to assets pipeline if a precompiled asset is missed.
+  config.assets.compile = false
+
+  # Asset digests allow you to set far-future HTTP expiration dates on all assets,
+  # yet still be able to expire them through the digest params.
+  config.assets.digest = true
+
   # `config.assets.precompile` and `config.assets.version` have moved to config/initializers/assets.rb
 
   # Specifies the header that your server uses for sending files.

data/spec/dummy/config/initializers/assets.rb

@@ -0,0 +1,11 @@
+# Be sure to restart your server when you modify this file.
+
+# Version of your assets, change this if you want to expire all your assets.
+Rails.application.config.assets.version = '1.0'
+
+# Add additional assets to the asset load path
+# Rails.application.config.assets.paths << Emoji.images_path
+
+# Precompile additional assets.
+# application.js, application.css, and all non-JS/CSS in app/assets folder are already added.
+# Rails.application.config.assets.precompile += %w( search.js )