panda_pal 5.14.0.beta6 → 5.14.0.beta8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ae8f2b11166468665c19a613c284a75f71e405ba9c810e82e1c4499920b76e0
-  data.tar.gz: 58bd014f1075394fc627cc4a118d1ab619ce89eb7857c1626171e69cc458e952
+  metadata.gz: 96e6b46ee78bbd2cec669b0a996af2731f2993869e17b8a911251ed58ff032e8
+  data.tar.gz: d166c1cce9c738d7b273f9a634cd0b0e315d938fb8950156e43870fdc8230d30
 SHA512:
-  metadata.gz: 2b2bc2227220be2668e04d7e6404cabb85c6f089b5f4bc33d8dfedd7af021c196a8c2baab452fd1b1d2c0bcdf5b4d0a4800df59e881c89817db5cbec2bf92f04
-  data.tar.gz: 38ae3968ee8f2b620191a42a55e896b7e9f2371528479ccde18a866712a8c1cd45091cfeb71d5db2d5109ad4c579109fa615e73110ebfdbbea8913e55dd66845
+  metadata.gz: cbe53c4546c8ef0d7552a2fc25e8522ccaf64d290a68802dee2b53525ef25d76e677870e9f9a05232eebcf20acb5e85a9d230afcfb2b03c56a68aec9b40d6202
+  data.tar.gz: 39bfddb95032c0070c3776b998536fd83fca8b013d3a0b6b4438889c57f7b26f52ee3394dfed124d9565a38f41a34c8e7e6b2fab329aba4816ed39cbbb809ede

data/config/initializers/apartment.rb

@@ -220,18 +220,19 @@ Apartment.configure do |config|
 end
 
 Rails.application.config.middleware.use Apartment::Elevators::Generic, lambda { |request|
-  if match = request.path.match(/\/(?:orgs?|organizations?)\/(\d+)/)
-    PandaPal::Organization.find_by(id: match[1]).try(:tenant_name)
-  elsif match = request.path.match(/\/(?:orgs?|organizations?|o)\/(\w+)/)
-    PandaPal::Organization.find_by(name: match[1]).try(:tenant_name)
-  elsif (panda_token = PandaPal::Helpers::SessionReplacement.extract_panda_token(request)).present?
-    header, sig = panda_token.split('.')
-    # This is just switching the tenant. Auth should be performed elsewhere (eg via `forbid_access_if_lacking_session`/`valid_session?`).
-    decoded_header = JSON.parse(Base64.urlsafe_decode64(header))
-    PandaPal::Organization.find_by(id: decoded_header['o']).try(:tenant_name)
-  elsif request.path.start_with?('/rails/active_storage/blobs/')
-    PandaPal::Organization.find_by(id: request.params['organization_id']).try(:tenant_name)
-  end
+  tenant = if match = request.path.match(/\/(?:orgs?|organizations?)\/(\d+)/)
+      PandaPal::Organization.find_by(id: match[1]).try(:tenant_name)
+    elsif match = request.path.match(/\/(?:orgs?|organizations?|o)\/(\w+)/)
+      PandaPal::Organization.find_by(name: match[1]).try(:tenant_name)
+    elsif (panda_token = PandaPal::Helpers::SessionReplacement.extract_panda_token(request)).present?
+      header, sig = panda_token.split('.')
+      # This is just switching the tenant. Auth should be performed elsewhere (eg via `forbid_access_if_lacking_session`/`valid_session?`).
+      decoded_header = JSON.parse(Base64.urlsafe_decode64(header))
+      PandaPal::Organization.find_by(id: decoded_header['o']).try(:tenant_name)
+    elsif request.path.start_with?('/rails/active_storage/blobs/')
+      PandaPal::Organization.find_by(id: request.params['organization_id']).try(:tenant_name)
+    end
+  tenant || 'public'
 }
 
 module PandaPal::Plugins::ApartmentCache

data/lib/panda_pal/helpers/controller_helper.rb

@@ -69,43 +69,41 @@ module PandaPal::Helpers
     def validate_v1p3_launch
       require "json/jwt"
 
-      login_session = nil
+      Apartment::Tenant.switch!("public")
 
-      switch_tenant("public") do
-        decoded_jwt = JSON::JWT.decode(params.require(:id_token), :skip_verification)
-        raise JSON::JWT::VerificationFailed, 'error decoding id_token' if decoded_jwt.blank?
+      decoded_jwt = JSON::JWT.decode(params.require(:id_token), :skip_verification)
+      raise JSON::JWT::VerificationFailed, 'error decoding id_token' if decoded_jwt.blank?
 
-        client_id = decoded_jwt['aud']
-        deployment_id = decoded_jwt['https://purl.imsglobal.org/spec/lti/claim/deployment_id']
+      client_id = decoded_jwt['aud']
+      deployment_id = decoded_jwt['https://purl.imsglobal.org/spec/lti/claim/deployment_id']
 
-        if deployment_id.present?
-          @organization ||= PandaPal::Organization.find_by(key: "#{client_id}/#{deployment_id}")
-          @organization ||= PandaPal::Organization.find_by(key: deployment_id)
-        end
+      if deployment_id.present?
+        @organization ||= PandaPal::Organization.find_by(key: "#{client_id}/#{deployment_id}")
+        @organization ||= PandaPal::Organization.find_by(key: deployment_id)
+      end
 
-        @organization ||= PandaPal::Organization.find_by(key: client_id)
+      @organization ||= PandaPal::Organization.find_by(key: client_id)
 
-        params[:session_key] = params[:state]
+      params[:session_key] = params[:state]
 
-        raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present?
-        raise JSON::JWT::VerificationFailed, 'Organization does not trust platform' unless @organization.trusted_platform?(current_lti_platform)
+      raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present?
+      raise JSON::JWT::VerificationFailed, 'Organization does not trust platform' unless @organization.trusted_platform?(current_lti_platform)
 
-        begin
-          decoded_jwt.verify!(current_lti_platform.public_jwks)
-        rescue JSON::JWK::Set::KidNotFound
-          decoded_jwt.verify!(current_lti_platform.public_jwks(force: true))
-        end
+      begin
+        decoded_jwt.verify!(current_lti_platform.public_jwks)
+      rescue JSON::JWK::Set::KidNotFound
+        decoded_jwt.verify!(current_lti_platform.public_jwks(force: true))
+      end
 
-        raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session.panda_pal_organization_id == 0
-        raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session[:lti_oauth_nonce] == decoded_jwt['nonce']
+      raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session.panda_pal_organization_id == 0
+      raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session[:lti_oauth_nonce] == decoded_jwt['nonce']
 
-        jwt_verifier = PandaPal::LtiJwtValidator.new(decoded_jwt, client_id)
-        raise JSON::JWT::VerificationFailed, jwt_verifier.errors unless jwt_verifier.valid?
+      jwt_verifier = PandaPal::LtiJwtValidator.new(decoded_jwt, client_id)
+      raise JSON::JWT::VerificationFailed, jwt_verifier.errors unless jwt_verifier.valid?
 
-        # Migrate the session to the correct tenant
-        login_session = current_panda_session
-        login_session.delete
-      end
+      # Migrate the session to the correct tenant
+      login_session = current_panda_session
+      login_session.delete
 
       @organization.switch_tenant
 

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "5.14.0.beta6"
+  VERSION = "5.14.0.beta8"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.14.0.beta6
+  version: 5.14.0.beta8
 platform: ruby
 authors:
 - Instructure CustomDev