panda_pal 5.16.20 → 5.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac02fef85d3184d63c9c8573a8695e52a424678747ab7a541a5f9483167ccc18
-  data.tar.gz: 54c1fbd8ad4d2f352f1d9b2843ef4c2705c63c8892942cedc8e5784840cb7820
+  metadata.gz: aa9bee5cce120a4bf340d69ebd142e6f11f8d65bb0b4d850bb781662469ba84e
+  data.tar.gz: b1040ec6ecbd33c7ff5fe0eef396a2e5d1764ec893a1c439b5cd8de0ec7d726c
 SHA512:
-  metadata.gz: c64c54373faafee3164496661d8bed6ae5a68d2852296966b1ffef4d738c82f29c675694bcbf0f7bc5f7c22246c6cacedc676393a7bcfa7bb4fd998d0033bcd5
-  data.tar.gz: aeb94f2be05936dc753d66172426d028ae1b47417410c506e819b76b40c8adb8932fb0ec8dc9933497b676f414794cc285ba36408daad537ca18ef0c2febeb9a
+  metadata.gz: 03ffb7a4bf0fe654ad310e8a8c34e69b1297ed02ab3a38a989d0712a630e2c41ca52cb76333ef0d400acabd3688a5c2d33621ab24d59027698e444581260403d
+  data.tar.gz: 522d2c9847b0225228d808a053a0eb278d872750883758bc60ccb87128162645fe989d7fa1e14f7fb9384fea69e7fae540dcaf02d4927f1691dc21c1f53223fe

data/app/models/panda_pal/platform/canvas.rb

@@ -38,7 +38,7 @@ module PandaPal
     end
 
     def is_trusted_env?
-      return true unless Rails.env.production?
+      return true if Rails.env.development? || Rails.env.test?
 
       TRUSTED_ISSUERS.include?(platform_uri)
     end

data/app/models/panda_pal/platform.rb

@@ -96,6 +96,8 @@ module PandaPal
   end
 
   class Platform::Generic < Platform
+    attr_reader :options
+
     def self.from_urls(base_url, jwks: nil, auth_redirect: nil, grant: nil)
       new({
         base_url: base_url,

data/app/models/panda_pal/session.rb

@@ -152,7 +152,7 @@ module PandaPal
     end
 
     def sign_value(data)
-      OpenSSL::HMAC.base64digest(OpenSSL::Digest.new('sha256'), signing_key, data)
+      Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), signing_key, data))
     end
 
     def validate_signature(data, signature)
@@ -239,24 +239,78 @@ module PandaPal
       labels.is_a?(String) ? labels.split(',') : []
     end
 
-    # Retrieve the User's Role Labels in the specified Account, defaulting to the Root Account
-    def canvas_account_role_labels(account = 'self')
+    # Retrieve the User's Role Labels in the specified Account.
+    #
+    # +account+ accepts an Account-like object (anything responding to
+    # +canvas_id+), a Canvas Account id, or one of:
+    #
+    # [<tt>'self'</tt>] the Account this Tool is installed on (the default).
+    # [<tt>:root</tt>]  a synonym for <tt>'self'</tt>. In an LTI context the
+    #                   installed Account IS the root of everything the Tool can
+    #                   see, and that — deliberately — need not be Canvas's own
+    #                   root Account: a Tool installed on a sub-account has no
+    #                   business reasoning about Accounts above its install.
+    #
+    # With <tt>inherited: true</tt>, roles held on any ANCESTOR of +account+ are
+    # included too, because a Canvas Account Admin administers their Account and
+    # everything beneath it — so an Admin above +account+ genuinely holds that
+    # role over +account+. Off by default: a caller asking "which roles are
+    # granted AT this Account" would not expect inherited ones, so opting in is
+    # explicit, as CanvasSync's +canvas_account_admin?+ does.
+    def canvas_account_role_labels(account = 'self', inherited: false)
       account = 'self' if account.to_s == "root"
       account = account.canvas_id if account.respond_to?(:canvas_id)
 
       if defined?(::Admin) && ::Admin < ::ActiveRecord::Base
-        account = current_organization.canvas_account_id if account == 'self'
-        adm_query = ::Admin.where(canvas_account_id: account, workflow_state: "active", canvas_user_id: canvas_user_id)
+        account = panda_pal_organization.canvas_account_id if account == 'self'
+        accounts = inherited ? canvas_account_ancestry(account) : [account]
+        adm_query = ::Admin.where(canvas_account_id: accounts, workflow_state: "active", canvas_user_id: canvas_user_id)
         adm_query.pluck(:role_name)
       else
-        Rails.cache.fetch([self.class.name, "AccountAdminLinks", account, canvas_user_id], expires_in: 1.hour) do
-          admin_entries = canvas_sync_client.account_admins(account, user_id: [canvas_user_id])
-          admin_entries = admin_entries.select{|ent| ent[:workflow_state] == 'active' }
-          admin_entries.map{|ent| ent[:role] }
+        Rails.cache.fetch([self.class.name, "AccountAdminLinks", account, inherited, canvas_user_id], expires_in: 1.hour) do
+          accounts = inherited ? canvas_account_ancestry(account) : [account]
+          accounts.flat_map { |acct|
+            admin_entries = canvas_sync_client.account_admins(acct, user_id: [canvas_user_id])
+            admin_entries = admin_entries.select{|ent| ent[:workflow_state] == 'active' }
+            admin_entries.map{|ent| ent[:role] }
+          }.uniq
         end
       end
     end
 
+    # +account+ plus every Account above it, nearest first.
+    #
+    # Reads the local Account mirror when the host app has one — no API traffic,
+    # and it works whether or not that model uses the +ancestry+ gem, since only
+    # +canvas_parent_account_id+ is needed. Falls back to walking Canvas.
+    #
+    # Traversal is topological and deliberately does NOT skip deleted Accounts:
+    # dropping one would silently truncate the chain and deny an Admin above it.
+    # Whether a role still counts is decided by the Admin record's own
+    # +workflow_state+, not by the shape of the tree.
+    def canvas_account_ancestry(account)
+      ids = [account]
+      seen = Set.new([account.to_s])
+
+      parent_of =
+        if defined?(::Account) && ::Account < ::ActiveRecord::Base
+          ->(id) { ::Account.find_by(canvas_id: id)&.canvas_parent_account_id }
+        else
+          ->(id) { canvas_sync_client.account(id)[:parent_account_id] }
+        end
+
+      current = account
+      while (parent = parent_of.call(current)).present?
+        break if seen.include?(parent.to_s) # cycle guard — never trust remote topology
+
+        ids << parent
+        seen << parent.to_s
+        current = parent
+      end
+
+      ids
+    end
+
     def lti_roles
       @lti_roles ||= RoleStore.new(launch_params["https://purl.imsglobal.org/spec/lti/claim/roles"] || launch_params['ext_roles'] || '')
     end

data/config/initializers/apartment.rb

@@ -130,6 +130,12 @@ module Apartment
         raise ActiveRecord::StatementInvalid, "Could not find schema for tenant #{tenant} (#{tenant_schemas.inspect})" unless schema_exists?(tenant_schemas)
 
         Apartment.connection.schema_search_path = full_search_path
+      rescue ActiveRecord::ConnectionNotEstablished
+        # Connection-acquisition failures (e.g. pool checkout timeouts) are unrelated to schema/search-path
+        # resolution. Let them propagate as themselves instead of masking them as Apartment::TenantNotFound,
+        # which sends whoever's debugging the error looking for a schema/tenant problem that doesn't exist.
+        @current = current_tenant
+        raise
       rescue *rescuable_exceptions => e
         @current = current_tenant
         raise_schema_connect_to_new(tenant, e)

data/lib/panda_pal/engine.rb

@@ -94,18 +94,18 @@ module PandaPal
         end
 
         def _panda_pal_console_env
-          if Rails.env.production?
-            env = ENV["SENTRY_CURRENT_ENV"].presence || "PROD"
+          if Rails.env.development?
+            PandaPal::ConsoleHelpers.cyan("dev")
+          elsif Rails.env.test?
+            PandaPal::ConsoleHelpers.cyan("test")
+          else
+            env = ENV["SENTRY_CURRENT_ENV"].presence || Rails.env.upcase || "PROD"
 
             if env.downcase.include?("prod")
               PandaPal::ConsoleHelpers.red(env)
             else
               PandaPal::ConsoleHelpers.cyan(env)
             end
-          elsif Rails.env.development?
-            PandaPal::ConsoleHelpers.cyan("dev")
-          elsif Rails.env.test?
-            PandaPal::ConsoleHelpers.cyan("test")
           end
         end
 

data/lib/panda_pal/helpers/controller_helper.rb

@@ -114,7 +114,7 @@ module PandaPal::Helpers
       @current_session.save!
 
       @decoded_lti_jwt = decoded_jwt
-    rescue JSON::JWT::VerificationFailed => e
+    rescue JSON::JWT::Exception => e
       payload = Array(e.message)
 
       render json: {

data/lib/panda_pal/helpers/secure_headers.rb

@@ -5,7 +5,7 @@ module PandaPal
       # The default cookie headers aren't compatable with PandaPal cookies currenntly
       config.cookies = { samesite: { none: true } }
 
-      if Rails.env.production?
+      unless Rails.env.development? || Rails.env.test?
         config.cookies[:secure] = true
       end
 

data/lib/panda_pal/helpers/session_replacement.rb

@@ -57,7 +57,7 @@ module PandaPal::Helpers
       current_panda_session
 
       if !@current_session && create_missing
-        Rails.logger.warn("current_session(create_missing: true) is deprecated. Use start_panda_session! instead.") unless Rails.env.production?
+        Rails.logger.warn("current_session(create_missing: true) is deprecated. Use start_panda_session! instead.") if Rails.env.development? || Rails.env.test?
         start_panda_session!
       end
 

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.16.20'
+  VERSION = '5.17.0'
 end

data/panda_pal.gemspec

@@ -23,8 +23,8 @@ Gem::Specification.new do |s|
   s.add_dependency "rails", ">= 4.2"
   s.add_dependency 'ros-apartment', '~> 3.0'
   s.add_dependency 'ims-lti', '~> 1.2.4'
-  s.add_dependency 'browser', '2.5.0'
-  s.add_dependency 'attr_encrypted', '~> 4.0.0'
+  s.add_dependency 'browser', '~> 5.3'
+  s.add_dependency 'attr_encrypted', '~> 4.2'
   s.add_dependency 'secure_headers', '>= 6.1', '< 8'
   s.add_dependency 'jwt'
   s.add_dependency 'httparty'

data/spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb

@@ -0,0 +1,110 @@
+require 'spec_helper'
+
+RSpec.describe "PandaPal::LtiV1P0Controller", type: :request do
+  let(:organization) { create(:panda_pal_organization) }
+  let(:launch_url) { panda_pal.v1p0_launch_url(host: 'www.example.com') }
+
+  # Signs a full LTI v1p0 launch params hash the same way an LMS (Tool Consumer)
+  # would, using the platform-side half of the very same `ims-lti` gem that
+  # PandaPal uses on the tool-provider side to validate incoming launches.
+  def signed_launch_params(secret:, timestamp: Time.now.to_i, launch_type: 'panda_pal')
+    consumer = IMS::LTI::ToolConsumer.new(organization.key, secret, {
+      'resource_link_id' => 'test-resource-link-id',
+    })
+    consumer.launch_url = launch_url
+    consumer.timestamp = timestamp
+    # `launch_type` isn't a spec'd LTI param, but the controller reads it from
+    # params, so it must be included in the signed payload or the signature
+    # PandaPal recomputes on the real request body won't match.
+    consumer.set_non_spec_param('launch_type', launch_type)
+    consumer.generate_launch_data
+  end
+
+  after do
+    # `validate_v1p0_launch` permanently switches the Apartment tenant to the
+    # organization's schema on a successful launch (PandaPal::Organization
+    # #switch_tenant with no block => Apartment::Tenant.switch!). Reset it so
+    # this doesn't leak into other spec files run later in the suite.
+    Apartment::Tenant.reset
+  end
+
+  describe 'POST /v1p0/launch' do
+    context 'with a validly-signed launch' do
+      it 'passes signature validation, starts a session, and redirects instead of rendering the 401 body' do
+        params = signed_launch_params(secret: organization.secret)
+
+        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
+
+        expect(response).not_to have_http_status(:unauthorized)
+        expect(response.body).not_to include('Failed to validate LTI v1p0 launch')
+        expect(response).to have_http_status(:found)
+        expect(response.headers['Location']).to include('/panda_pal')
+
+        # The session record is created after PandaPal switches Apartment tenants
+        # to the organization's own schema, so look it up there.
+        session_count = organization.switch_tenant { PandaPal::Session.count }
+        expect(session_count).to eq(1)
+      end
+    end
+
+    context 'with an invalid signature (wrong secret used to sign)' do
+      it 'renders 401 with the failure body' do
+        params = signed_launch_params(secret: 'not-the-real-secret')
+
+        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
+      end
+    end
+
+    context 'with a tampered parameter after signing' do
+      it 'renders 401 with the failure body' do
+        params = signed_launch_params(secret: organization.secret)
+        params['resource_link_id'] = 'a-different-resource-link-id'
+
+        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
+      end
+    end
+
+    context 'with a stale oauth_timestamp' do
+      it 'renders 401 without ever consulting IMS::LTI::ToolProvider' do
+        stale_timestamp = 400.seconds.ago.to_i
+        params = signed_launch_params(secret: organization.secret, timestamp: stale_timestamp)
+
+        expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
+      end
+    end
+  end
+
+  describe 'safari_override (browser gem regression coverage)' do
+    let(:safari_user_agent) do
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
+    end
+    let(:chrome_user_agent) do
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
+    end
+
+    # safari_override is the very first thing validate_launch! does, before any
+    # OAuth/org checks, so an otherwise-invalid launch is sufficient to exercise it.
+    it 'applies the secure_headers safari override when the User-Agent is Safari' do
+      expect_any_instance_of(PandaPal::LtiV1P0Controller).to receive(:use_secure_headers_override).with(:safari_override)
+
+      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => safari_user_agent }
+    end
+
+    it 'does not apply the override for a non-Safari User-Agent (Chrome)' do
+      expect_any_instance_of(PandaPal::LtiV1P0Controller).not_to receive(:use_secure_headers_override)
+
+      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => chrome_user_agent }
+    end
+  end
+end

data/spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb

@@ -0,0 +1,78 @@
+require 'spec_helper'
+require 'nokogiri'
+
+RSpec.describe "PandaPal::LtiV1P3Controller", type: :request do
+  describe 'GET /v1p3/public_jwks' do
+    let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
+    let(:test_jwk) { JWT::JWK.new(rsa_key, { use: 'sig', alg: 'RS256' }) }
+
+    before { PandaPal.jwk = test_jwk }
+
+    after do
+      # PandaPal.jwk memoizes into a class variable (`@@jwk ||= ...`). Reset it
+      # so our test key doesn't leak into other spec files run later in the suite.
+      PandaPal.jwk = nil
+    end
+
+    it 'renders a 200 JSON JWK Set whose key matches PandaPal.jwk, with no private key material' do
+      get "/panda_pal/v1p3/public_jwks"
+
+      expect(response).to have_http_status(:ok)
+
+      expected_body = JSON.parse(JWT::JWK::Set.new(test_jwk).export.to_json)
+      body = JSON.parse(response.body)
+
+      expect(body).to eq(expected_body)
+      expect(body['keys']).to be_an(Array)
+      expect(body['keys'].length).to eq(1)
+
+      returned_key = body['keys'].first
+      expect(returned_key['kty']).to eq('RSA')
+      expect(returned_key['use']).to eq('sig')
+      expect(returned_key['alg']).to eq('RS256')
+      expect(returned_key['n']).to eq(test_jwk[:n])
+      expect(returned_key['e']).to eq(test_jwk[:e])
+      # Only the public modulus/exponent should ever be exposed - never private key material.
+      expect(returned_key.keys).not_to include('d', 'p', 'q', 'dp', 'dq', 'qi')
+    end
+  end
+
+  describe 'GET /v1p3/oidc_login' do
+    let(:login_params) do
+      {
+        client_id: 'test-client-id',
+        login_hint: 'test-login-hint',
+        lti_message_hint: 'test-lti-message-hint',
+        iss: 'https://canvas.instructure.com',
+      }
+    end
+
+    it 'renders the auto-submit form targeting the platform auth redirect URL, with the expected hidden fields' do
+      get "/panda_pal/v1p3/oidc_login", params: login_params
+
+      expect(response).to have_http_status(:ok)
+
+      doc = Nokogiri::HTML(response.body)
+      form = doc.at_css('form#redirect-form')
+      expect(form).not_to be_nil
+
+      created_session = PandaPal::Session.order(:id).last
+      expect(created_session).not_to be_nil
+
+      expect(form['action']).to eq(PandaPal::Platform::Canvas.new(iss: 'https://canvas.instructure.com').authentication_redirect_url)
+
+      hidden_fields = form.css('input[type=hidden]').each_with_object({}) do |input, h|
+        h[input['name']] = input['value']
+      end
+
+      expect(hidden_fields['client_id']).to eq('test-client-id')
+      expect(hidden_fields['login_hint']).to eq('test-login-hint')
+      expect(hidden_fields['lti_message_hint']).to eq('test-lti-message-hint')
+      expect(hidden_fields['scope']).to eq('openid')
+      expect(hidden_fields['response_type']).to eq('id_token')
+      expect(hidden_fields['state']).to eq(created_session.session_key)
+      expect(hidden_fields['nonce']).to eq(created_session[:lti_oauth_nonce])
+      expect(hidden_fields['nonce']).not_to be_blank
+    end
+  end
+end

data/spec/core/apartment_multidb_spec.rb

@@ -68,4 +68,33 @@ RSpec.describe PandaPal::Organization, type: :model do
       end
     end
   end
+
+  context "tenant switch error wrapping" do
+    around do |example|
+      original = Apartment.with_multi_server_setup
+      Apartment.configure { |c| c.with_multi_server_setup = true }
+      Apartment::Tenant.reload!
+      example.run
+    ensure
+      Apartment.configure { |c| c.with_multi_server_setup = original }
+      Apartment::Tenant.reload!
+    end
+
+    it "does not mask a connection pool timeout as Apartment::TenantNotFound (PFS-31252)" do
+      adapter = Apartment::Tenant.adapter
+      previous_tenant = adapter.current
+
+      allow(ActiveRecord::Base).to receive(:connection) do
+        # Un-stub before raising: ActiveRecord::Base.connection is inherited by
+        # ros-apartment's SeparateDbConnectionHandler (used for schema create/drop),
+        # so leaving the stub in place past this one intended failure would misroute
+        # unrelated connection lookups made elsewhere.
+        allow(ActiveRecord::Base).to receive(:connection).and_call_original
+        raise ActiveRecord::ConnectionTimeoutError, "could not obtain a connection from the pool within 5.000 seconds"
+      end
+
+      expect { adapter.connect_to_new("alt:some_org") }.to raise_error(ActiveRecord::ConnectionTimeoutError)
+      expect(adapter.current).to eq(previous_tenant)
+    end
+  end
 end

data/spec/factories/panda_pal_sessions.rb

@@ -1,7 +1,6 @@
 FactoryBot.define do
   factory :panda_pal_session, class: 'PandaPal::Session' do
-    session_secret { "MyString" }
-    organization { nil }
+    panda_pal_organization { nil }
     data { "MyText" }
   end
 end

data/spec/internal/app/models/account.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# Minimal stand-in for the CanvasSync-generated Account. Present so that
+# Session#canvas_account_ancestry exercises its local-mirror branch (the one
+# host apps actually hit) rather than the Canvas API fallback.
+class Account < ActiveRecord::Base
+end

data/spec/internal/app/models/admin.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Minimal stand-in for the CanvasSync-generated Admin roster model that
+# Session#canvas_account_role_labels reads role labels from.
+class Admin < ActiveRecord::Base
+end

data/spec/internal/db/schema.rb

@@ -3,4 +3,28 @@
 ActiveRecord::Schema.define do
   # Set up any tables you need to exist for your test suite that don't belong
   # in migrations.
+
+  # Stand-ins for the CanvasSync-generated, tenant-scoped models that
+  # Session#canvas_account_role_labels duck-types on. Only the columns it
+  # actually reads are declared. `accounts` deliberately has NO `ancestry`
+  # column: that gem is optional in host apps, so the traversal has to work
+  # from `canvas_parent_account_id` alone.
+  create_table :accounts, force: true do |t|
+    t.bigint :canvas_id, null: false
+    t.bigint :canvas_parent_account_id
+    t.string :name
+    t.string :workflow_state, default: "active"
+    t.timestamps
+  end
+  add_index :accounts, :canvas_id, unique: true
+
+  create_table :admins, force: true do |t|
+    t.bigint :canvas_id
+    t.bigint :canvas_user_id, null: false
+    t.bigint :canvas_account_id, null: false
+    t.string :role_name
+    t.string :workflow_state, default: "active"
+    t.timestamps
+  end
+  add_index :admins, [ :canvas_user_id, :canvas_account_id ]
 end

data/spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb

@@ -0,0 +1,83 @@
+require 'spec_helper'
+
+module PandaPal::Jobs
+  RSpec.describe GradePassbackJob, type: :job do
+    let(:organization) { create(:panda_pal_organization) }
+    let(:job) { described_class.new }
+
+    describe '#perform' do
+      context 'with missing required params' do
+        it 'raises MissingGradePassbackParams when passback_guid is missing' do
+          expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+          expect {
+            job.perform(organization, { passback_url: 'http://example.com/passback', score: 0.9 })
+          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
+        end
+
+        it 'raises MissingGradePassbackParams when passback_url is missing' do
+          expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+          expect {
+            job.perform(organization, { passback_guid: 'guid-123', score: 0.9 })
+          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
+        end
+
+        it 'raises MissingGradePassbackParams when both score and total_score are missing' do
+          expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+          expect {
+            job.perform(organization, { passback_guid: 'guid-123', passback_url: 'http://example.com/passback' })
+          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
+        end
+
+        it 'raises MissingGradePassbackParams when opts is entirely empty' do
+          expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+          expect {
+            job.perform(organization, {})
+          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
+        end
+      end
+
+      context 'with valid options' do
+        let(:opts) { { passback_guid: 'guid-123', passback_url: 'http://example.com/passback', score: 0.9 } }
+        let(:tool_provider_double) { double('IMS::LTI::ToolProvider') }
+
+        before do
+          allow(IMS::LTI::ToolProvider).to receive(:new)
+            .with(organization.key, organization.secret, hash_including(
+              'lis_result_sourcedid' => opts[:passback_guid],
+              'lis_outcome_service_url' => opts[:passback_url]
+            ))
+            .and_return(tool_provider_double)
+        end
+
+        it 'posts to the LMS and does not raise when the response is successful' do
+          success_result = double('OutcomeResponse', success?: true)
+          expect(tool_provider_double).to receive(:post_extended_replace_result!).with(opts).and_return(success_result)
+
+          expect {
+            job.perform(organization, opts)
+          }.not_to raise_error
+        end
+
+        it 'raises GradePassbackFailure when the tool provider reports failure' do
+          failure_result = double(
+            'OutcomeResponse',
+            success?: false,
+            response_code: 500,
+            code_major: 'failure',
+            severity: 'error',
+            description: 'boom'
+          )
+          expect(tool_provider_double).to receive(:post_extended_replace_result!).with(opts).and_return(failure_result)
+
+          expect {
+            job.perform(organization, opts)
+          }.to raise_error(PandaPal::Jobs::GradePassbackFailure)
+        end
+      end
+    end
+  end
+end

data/spec/lib/panda_pal/helpers/secure_headers_spec.rb

@@ -0,0 +1,77 @@
+require 'spec_helper'
+
+RSpec.describe PandaPal::SecureHeaders do
+  subject(:config) { SecureHeaders::Configuration.new }
+
+  describe '.apply_defaults' do
+    before { described_class.apply_defaults(config) }
+
+    it 'returns the same configuration object it was given' do
+      expect(described_class.apply_defaults(config)).to equal(config)
+    end
+
+    it 'relaxes the default cookie samesite restriction for LTI iframes' do
+      expect(config.cookies).to eq(samesite: { none: true })
+    end
+
+    it 'does not mark cookies secure outside of production' do
+      expect(config.cookies[:secure]).to be_nil
+    end
+
+    it 'allows the app to be embedded in LTI iframes' do
+      expect(config.x_frame_options).to eq('ALLOWALL')
+    end
+
+    it 'sets baseline browser protection headers' do
+      expect(config.x_content_type_options).to eq('nosniff')
+      expect(config.x_xss_protection).to eq('1; mode=block')
+      expect(config.referrer_policy).to eq(%w(origin-when-cross-origin strict-origin-when-cross-origin))
+    end
+
+    it 'restricts default_src, connect_src, and script_src to self' do
+      expect(config.csp[:default_src]).to include("'self'")
+      expect(config.csp[:connect_src]).to include("'self'")
+      expect(config.csp[:script_src]).to include("'self'")
+    end
+
+    it 'allows inline styles and Google Fonts for CSS-in-JS libraries' do
+      expect(config.csp[:style_src]).to include("'self'", "'unsafe-inline'", 'blob:', 'https://fonts.googleapis.com')
+      expect(config.csp[:font_src]).to include("'self'", 'data:', 'https://fonts.gstatic.com')
+    end
+
+    it 'does not add development-only CSP allowances outside of development' do
+      expect(config.csp[:script_src]).not_to include("'unsafe-eval'")
+      expect(config.csp[:connect_src]).not_to include('http://localhost:3035')
+    end
+  end
+
+  describe '.apply_defaults in production' do
+    around do |example|
+      original_env = Rails.env
+      begin
+        Rails.env = 'production'
+        example.run
+      ensure
+        Rails.env = original_env
+      end
+    end
+
+    it 'marks cookies as secure' do
+      described_class.apply_defaults(config)
+      expect(config.cookies[:secure]).to be true
+    end
+  end
+
+  describe '.csp_entry' do
+    it 'merges values into the directive without duplicating existing entries' do
+      config.csp[:default_src] = ["'self'"]
+      described_class.instance_variable_set(:@config, config)
+
+      described_class.send(:csp_entry, :default_src, "'self'", 'https://example.com')
+
+      expect(config.csp[:default_src]).to eq(["'self'", 'https://example.com'])
+    ensure
+      described_class.instance_variable_set(:@config, nil)
+    end
+  end
+end

data/spec/models/panda_pal/platform_spec.rb

@@ -0,0 +1,152 @@
+require 'spec_helper'
+
+module PandaPal
+  RSpec.describe Platform, type: :model do
+    describe '.resolve_platform / .resolve_platform_class' do
+      context 'with the default configuration (no :platform option set)' do
+        it 'resolves to the Canvas platform class' do
+          expect(Platform.resolve_platform_class(iss: 'https://canvas.instructure.com')).to eq(Platform::Canvas)
+        end
+
+        it 'resolves to an instance of the Canvas platform, initialized with the issuer' do
+          resolved = Platform.resolve_platform(iss: 'https://canvas.instructure.com')
+
+          expect(resolved).to be_a(Platform::Canvas)
+          expect(resolved.platform_uri).to eq('https://canvas.instructure.com')
+        end
+      end
+
+      context 'when :platform is configured as a class name string' do
+        before do
+          PandaPal.lti_options = PandaPal.lti_options.merge(platform: 'PandaPal::Platform::Generic')
+        end
+
+        it 'resolves to that class' do
+          expect(Platform.resolve_platform_class(iss: 'https://lms.example.com')).to eq(Platform::Generic)
+        end
+
+        it 'resolves to an instance of that class' do
+          resolved = Platform.resolve_platform(iss: 'https://lms.example.com')
+          expect(resolved).to be_a(Platform::Generic)
+        end
+      end
+
+      context 'when :platform is configured as a Proc' do
+        it 'uses the class returned by the proc' do
+          PandaPal.lti_options = PandaPal.lti_options.merge(
+            platform: proc { |params| params[:iss] == 'https://special.example.com' ? Platform::Generic : nil }
+          )
+
+          expect(Platform.resolve_platform_class(iss: 'https://special.example.com')).to eq(Platform::Generic)
+        end
+
+        it 'falls through to the trusted-issuer default when the proc returns nil' do
+          PandaPal.lti_options = PandaPal.lti_options.merge(platform: proc { |_params| nil })
+
+          expect(Platform.resolve_platform_class(iss: 'https://canvas.beta.instructure.com')).to eq(Platform::Canvas)
+        end
+      end
+
+      context 'when :platform is configured as a Symbol' do
+        before do
+          Object.define_singleton_method(:panda_pal_spec_platform_resolver) { |_params| Platform::Generic }
+          PandaPal.lti_options = PandaPal.lti_options.merge(platform: :panda_pal_spec_platform_resolver)
+        end
+
+        after do
+          Object.singleton_class.send(:remove_method, :panda_pal_spec_platform_resolver)
+        end
+
+        it 'calls the named method on Object and uses the returned class' do
+          expect(Platform.resolve_platform_class(iss: 'https://lms.example.com')).to eq(Platform::Generic)
+        end
+      end
+
+      context 'when the configured platform string does not resolve to a class' do
+        before do
+          PandaPal.lti_options = PandaPal.lti_options.merge(platform: 'NotARealPlatformClassXYZ')
+        end
+
+        it 'falls back to Canvas for a trusted Canvas issuer' do
+          expect(Platform.resolve_platform_class(iss: 'https://canvas.beta.instructure.com')).to eq(Platform::Canvas)
+        end
+
+        it 'raises for an untrusted issuer' do
+          expect {
+            Platform.resolve_platform_class(iss: 'https://not-trusted.example.com')
+          }.to raise_error(RuntimeError, /Unknown platform/)
+        end
+      end
+    end
+
+    describe Platform::Generic do
+      describe '.from_urls' do
+        it 'stores the given URLs for later use' do
+          platform = described_class.from_urls(
+            'https://lms.example.com',
+            jwks: '/custom/jwks',
+            auth_redirect: '/custom/auth',
+            grant: '/custom/grant'
+          )
+
+          expect(platform.options).to eq(
+            base_url: 'https://lms.example.com',
+            jwks_url: '/custom/jwks',
+            auth_redirect_url: '/custom/auth',
+            grant_url: '/custom/grant'
+          )
+        end
+
+        it 'derives platform_uri from base_url' do
+          platform = described_class.from_urls('https://lms.example.com')
+
+          expect(platform.platform_uri).to eq('https://lms.example.com')
+        end
+
+        it 'derives jwks_url from base_url, using the default path when none given' do
+          platform = described_class.from_urls('https://lms.example.com')
+
+          expect(platform.jwks_url).to eq('https://lms.example.com/api/lti/security/jwks')
+        end
+
+        it 'derives jwks_url from a custom path when given' do
+          platform = described_class.from_urls('https://lms.example.com', jwks: '/custom/jwks')
+
+          expect(platform.jwks_url).to eq('https://lms.example.com/custom/jwks')
+        end
+
+        it 'derives authentication_redirect_url from base_url, using the default path when none given' do
+          platform = described_class.from_urls('https://lms.example.com')
+
+          expect(platform.authentication_redirect_url).to eq('https://lms.example.com/api/lti/authorize_redirect')
+        end
+
+        it 'derives grant_url from base_url, using the default path when none given' do
+          platform = described_class.from_urls('https://lms.example.com')
+
+          expect(platform.grant_url).to eq('https://lms.example.com/login/oauth2/token')
+        end
+      end
+    end
+
+    describe '#serialize / .from_serialized' do
+      it 'round-trips a Canvas platform' do
+        platform = Platform::Canvas.new(iss: 'https://canvas.instructure.com')
+        restored = Platform.from_serialized(platform.serialize)
+
+        expect(restored).to be_a(Platform::Canvas)
+        expect(restored.platform_uri).to eq(platform.platform_uri)
+        expect(restored.jwks_url).to eq(platform.jwks_url)
+      end
+
+      it 'round-trips a Generic platform' do
+        platform = Platform::Generic.from_urls('https://lms.example.com', jwks: '/custom/jwks')
+        restored = Platform.from_serialized(platform.serialize)
+
+        expect(restored).to be_a(Platform::Generic)
+        expect(restored.platform_uri).to eq(platform.platform_uri)
+        expect(restored.jwks_url).to eq(platform.jwks_url)
+      end
+    end
+  end
+end

data/spec/models/panda_pal/session_account_roles_spec.rb

@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+module PandaPal
+  RSpec.describe Session, type: :model do
+    describe '#canvas_account_role_labels' do
+      # The Tool is installed on a SUB-ACCOUNT here, which is the only topology
+      # that distinguishes the install Account from Canvas's own root. A Tool
+      # installed at the top is the degenerate case where every reading of
+      # "root" agrees, so it can't tell a correct implementation from a broken
+      # one.
+      #
+      #   1 root
+      #   └── 20 parent
+      #       └── 300 install   <- current_organization.canvas_account_id
+      #           └── 4000 child
+      #   └── 21 sibling
+      let(:canvas_user_id) { 9001 }
+      let!(:organization) { create(:panda_pal_organization, canvas_account_id: 300) }
+      # Created BEFORE the tenant switch below: panda_pal_sessions lives outside
+      # the tenant schema, while accounts/admins live inside it.
+      let!(:session) do
+        create(:panda_pal_session, panda_pal_organization: organization, data: {
+          launch_params: {
+            "https://purl.imsglobal.org/spec/lti/claim/custom" => { "canvas_user_id" => canvas_user_id },
+          },
+        })
+      end
+
+      def admin!(account_id, role_name: "AccountAdmin", workflow_state: "active")
+        Admin.create!(canvas_user_id: canvas_user_id, canvas_account_id: account_id,
+                      role_name: role_name, workflow_state: workflow_state)
+      end
+
+      before do
+        organization.switch_tenant
+        Account.create!(canvas_id: 1,    canvas_parent_account_id: nil, name: "root")
+        Account.create!(canvas_id: 20,   canvas_parent_account_id: 1,   name: "parent")
+        Account.create!(canvas_id: 21,   canvas_parent_account_id: 1,   name: "sibling")
+        Account.create!(canvas_id: 300,  canvas_parent_account_id: 20,  name: "install")
+        Account.create!(canvas_id: 4000, canvas_parent_account_id: 300, name: "child")
+      end
+
+      after { Apartment::Tenant.reset }
+
+      context 'by default (inherited: false)' do
+        it 'returns roles held at the install Account' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels).to eq(["AccountAdmin"])
+        end
+
+        it 'ignores roles held above the install Account' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels).to eq([])
+        end
+
+        it 'treats :root as the install Account, not as Canvas account 1' do
+          admin!(300, role_name: "Ops")
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(:root)).to eq(["Ops"])
+        end
+
+        it 'reads an explicitly requested Account' do
+          admin!(4000, role_name: "Sub-Account Admin")
+
+          expect(session.canvas_account_role_labels(4000)).to eq(["Sub-Account Admin"])
+        end
+      end
+
+      context 'with inherited: true' do
+        it 'includes a role held on the immediate parent' do
+          admin!(20, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'includes a role held on Canvas\'s root Account, several levels up' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(:root, inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'still includes a role held at the Account itself' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'does NOT include a role held BELOW the Account' do
+          admin!(4000, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'does NOT include a role held on a sibling branch' do
+          admin!(21, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'excludes inactive rows anywhere in the chain' do
+          admin!(1, role_name: "AccountAdmin", workflow_state: "inactive")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'ignores another user\'s roles in the chain' do
+          Admin.create!(canvas_user_id: canvas_user_id + 1, canvas_account_id: 1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'gathers roles from several levels at once' do
+          admin!(300, role_name: "Ops")
+          admin!(20,  role_name: "Department Admin")
+          admin!(1,   role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true))
+            .to contain_exactly("Ops", "Department Admin", "AccountAdmin")
+        end
+
+        it 'walks up from an explicitly requested Account, not from the install' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(4000, inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'accepts an Account-like object' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(Account.find_by(canvas_id: 300), inherited: true))
+            .to eq(["AccountAdmin"])
+        end
+      end
+    end
+
+    describe '#canvas_account_ancestry' do
+      let!(:organization) { create(:panda_pal_organization, canvas_account_id: 300) }
+      let!(:session) { create(:panda_pal_session, panda_pal_organization: organization, data: {}) }
+
+      before { organization.switch_tenant }
+      after { Apartment::Tenant.reset }
+
+      it 'returns the Account plus its ancestors, nearest first' do
+        Account.create!(canvas_id: 1,   canvas_parent_account_id: nil)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 1)
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20, 1 ])
+      end
+
+      it 'returns just the Account when it is already the top' do
+        Account.create!(canvas_id: 1, canvas_parent_account_id: nil)
+
+        expect(session.canvas_account_ancestry(1)).to eq([ 1 ])
+      end
+
+      it 'returns the id unchanged when the Account is not in the local mirror' do
+        expect(session.canvas_account_ancestry(300)).to eq([ 300 ])
+      end
+
+      it 'stops rather than looping forever on a cyclic hierarchy' do
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 300)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20 ])
+      end
+
+      it 'keeps walking through a deleted intermediate Account' do
+        Account.create!(canvas_id: 1,   canvas_parent_account_id: nil)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 1, workflow_state: "deleted")
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20, 1 ])
+      end
+    end
+  end
+end

data/spec/models/panda_pal/session_spec.rb

@@ -5,5 +5,151 @@ module PandaPal
     it 'is initialized with a session_secret' do
       expect(PandaPal::Session.new.session_secret).to_not be_nil
     end
+
+    describe '.for_panda_token' do
+      it 'returns nil for a nil token' do
+        expect(Session.for_panda_token(nil)).to be_nil
+      end
+
+      it 'returns nil for an empty token' do
+        expect(Session.for_panda_token('')).to be_nil
+      end
+
+      context 'with a KEY-type token' do
+        let(:session) { create(:panda_pal_session) }
+
+        it 'returns the matching session record' do
+          found = Session.for_panda_token(session.session_key, enforce_tenant: false)
+          expect(found).to eq(session)
+        end
+
+        it 'raises SessionNonceMismatch when the secret in the signature is wrong' do
+          header, _sig = session.session_key.split('.')
+          tampered_token = "#{header}.not-the-real-secret"
+
+          expect {
+            Session.for_panda_token(tampered_token, enforce_tenant: false)
+          }.to raise_error(Session::SessionNonceMismatch)
+        end
+
+        it 'raises SessionNonceMismatch when the payload session id does not match the found record' do
+          other_session = create(:panda_pal_session)
+
+          header, sig = session.session_key.split('.')
+          payload = JSON.parse(Base64.urlsafe_decode64(header))
+          payload['s'] = other_session.id
+          tampered_header = Base64.urlsafe_encode64(payload.to_json)
+          tampered_token = "#{tampered_header}.#{sig}"
+
+          expect {
+            Session.for_panda_token(tampered_token, enforce_tenant: false)
+          }.to raise_error(Session::SessionNonceMismatch)
+        end
+      end
+    end
+
+    describe '#sign_value / #validate_signature' do
+      it 'produces a base64-encoded HMAC-SHA256 digest without relying on OpenSSL::HMAC.base64digest' do
+        session = build(:panda_pal_session)
+
+        # OpenSSL::HMAC.base64digest doesn't exist at all on some Rubies' bundled
+        # openssl gem (that's the bug this test guards against) -- only assert the
+        # negative expectation where the method exists to negate; the correctness
+        # check below is what actually proves sign_value doesn't depend on it.
+        expect(OpenSSL::HMAC).not_to receive(:base64digest) if OpenSSL::HMAC.respond_to?(:base64digest)
+        signature = session.sign_value('some-data-to-sign')
+
+        expected = Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), session.session_secret, 'some-data-to-sign'))
+        expect(signature).to eq(expected)
+      end
+
+      it 'validates a signature produced by the same session' do
+        session = build(:panda_pal_session)
+        signature = session.sign_value('some-data-to-sign')
+
+        expect(session.validate_signature('some-data-to-sign', signature)).to be true
+      end
+
+      it 'does not validate a signature produced by a different session' do
+        session = build(:panda_pal_session)
+        other_session = build(:panda_pal_session)
+
+        signature_from_other = other_session.sign_value('some-data-to-sign')
+
+        expect(session.validate_signature('some-data-to-sign', signature_from_other)).to be false
+      end
+    end
+
+    describe '.extract_panda_token' do
+      it 'extracts the token from the X-Panda-Token header (HTTP_ form)' do
+        request = double('request', headers: { 'HTTP_X_PANDA_TOKEN' => 'header.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('header.token')
+      end
+
+      it 'extracts the token from the X-Panda-Token header (raw form)' do
+        request = double('request', headers: { 'X-Panda-Token' => 'header.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('header.token')
+      end
+
+      it 'falls back to request.env when the request does not respond to headers' do
+        request = double('request', env: { 'HTTP_X_PANDA_TOKEN' => 'env.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('env.token')
+      end
+
+      it 'extracts the token from an "Authorization: Bearer panda:<token>" header' do
+        request = double('request', headers: { 'HTTP_AUTHORIZATION' => 'Bearer panda:bearer.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('bearer.token')
+      end
+
+      it 'extracts the token from the raw Authorization header key' do
+        request = double('request', headers: { 'Authorization' => 'Bearer panda:bearer.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('bearer.token')
+      end
+
+      it 'extracts the token from the legacy "Authorization: token=<token>" header format' do
+        request = double('request', headers: { 'HTTP_AUTHORIZATION' => 'token=legacy.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('legacy.token')
+      end
+
+      it 'extracts the token from params["panda_token"]' do
+        request = double('request', headers: {})
+        expect(Session.extract_panda_token(request, { 'panda_token' => 'params.token' })).to eq('params.token')
+      end
+
+      it 'extracts the token from the legacy params["session_token"]' do
+        request = double('request', headers: {})
+        expect(Session.extract_panda_token(request, { 'session_token' => 'legacy.session.token' })).to eq('legacy.session.token')
+      end
+
+      it 'extracts the token from the legacy params["session_key"]' do
+        request = double('request', headers: {})
+        expect(Session.extract_panda_token(request, { 'session_key' => 'legacy.session.key.token' })).to eq('legacy.session.key.token')
+      end
+
+      it 'returns nil when nothing is present' do
+        request = double('request', headers: {})
+        expect(Session.extract_panda_token(request, {})).to be_nil
+      end
+    end
+
+    describe '.format_url_for_signing' do
+      it 'strips panda_token, session_key, and session_token but keeps other params' do
+        url = 'https://example.com/some/path?panda_token=tok&foo=bar&session_key=abc&baz=qux&session_token=def'
+
+        expect(Session.format_url_for_signing(url)).to eq('/some/path?foo=bar&baz=qux')
+      end
+
+      it 'accepts a URI object directly' do
+        uri = URI.parse('https://example.com/some/path?panda_token=tok&foo=bar')
+
+        expect(Session.format_url_for_signing(uri)).to eq('/some/path?foo=bar')
+      end
+
+      it 'produces an empty query string when no params remain' do
+        url = 'https://example.com/some/path?panda_token=tok'
+
+        expect(Session.format_url_for_signing(url)).to eq('/some/path?')
+      end
+    end
   end
 end

data/spec/spec_helper.rb

@@ -1,5 +1,12 @@
 # ENV["RAILS_ENV"] ||= 'test'
 
+if ENV['COVERAGE']
+  require 'simplecov'
+  SimpleCov.start do
+    add_filter '/spec/'
+  end
+end
+
 require 'bundler'
 Bundler.require :default, :development
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.16.20
+  version: 5.17.0
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -55,30 +55,30 @@ dependencies:
   name: browser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.5.0
+        version: '5.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.5.0
+        version: '5.3'
 - !ruby/object:Gem::Dependency
   name: attr_encrypted
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: '4.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: '4.2'
 - !ruby/object:Gem::Dependency
   name: secure_headers
   requirement: !ruby/object:Gem::Requirement
@@ -197,17 +197,25 @@ files:
 - lib/tasks/panda_pal_tasks.rake
 - panda_pal.gemspec
 - spec/controllers/panda_pal/api_call_controller_spec.rb
+- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
+- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
 - spec/core/apartment_multidb_spec.rb
 - spec/factories/panda_pal_organizations.rb
 - spec/factories/panda_pal_sessions.rb
+- spec/internal/app/models/account.rb
+- spec/internal/app/models/admin.rb
 - spec/internal/config/database.yml
 - spec/internal/config/routes.rb
 - spec/internal/config/storage.yml
 - spec/internal/db/schema.rb
+- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
+- spec/lib/panda_pal/helpers/secure_headers_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
 - spec/models/panda_pal/organization/settings_validation_spec.rb
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
 - spec/models/panda_pal/organization_spec.rb
+- spec/models/panda_pal/platform_spec.rb
+- spec/models/panda_pal/session_account_roles_spec.rb
 - spec/models/panda_pal/session_spec.rb
 - spec/spec_helper.rb
 homepage: http://instructure.com
@@ -233,16 +241,24 @@ specification_version: 4
 summary: LTI mountable engine
 test_files:
 - spec/controllers/panda_pal/api_call_controller_spec.rb
+- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
+- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
 - spec/core/apartment_multidb_spec.rb
 - spec/factories/panda_pal_organizations.rb
 - spec/factories/panda_pal_sessions.rb
+- spec/internal/app/models/account.rb
+- spec/internal/app/models/admin.rb
 - spec/internal/config/database.yml
 - spec/internal/config/routes.rb
 - spec/internal/config/storage.yml
 - spec/internal/db/schema.rb
+- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
+- spec/lib/panda_pal/helpers/secure_headers_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
 - spec/models/panda_pal/organization/settings_validation_spec.rb
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
 - spec/models/panda_pal/organization_spec.rb
+- spec/models/panda_pal/platform_spec.rb
+- spec/models/panda_pal/session_account_roles_spec.rb
 - spec/models/panda_pal/session_spec.rb
 - spec/spec_helper.rb