panda_pal 5.16.21 → 5.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a5f35f89d8e121395cef557e6305357a29eab6ea9a63434ec3a38548c92d566
-  data.tar.gz: 6fccf06a199c9c59c01ebb0981cbfb4f86b374303cd7a30521fa0fa604705b9c
+  metadata.gz: aa9bee5cce120a4bf340d69ebd142e6f11f8d65bb0b4d850bb781662469ba84e
+  data.tar.gz: b1040ec6ecbd33c7ff5fe0eef396a2e5d1764ec893a1c439b5cd8de0ec7d726c
 SHA512:
-  metadata.gz: 4b23c1838a9a7b19a8c82d0f57f24d5c2b97ed4d2265379c52832b00ce7fd742bad1388d0697391a594908e2a1dac0f3b65c28cbbf1d2dbe6d1ec3ae6ba2cd68
-  data.tar.gz: 578b81b0921ae8fa4ed8b8bb99ed2c00326fa354c08dc8ff9aca4d354a752aded035aee21658654283369bf29e74eee17b7ba4f900e8ad8fe6594d55ead280fd
+  metadata.gz: 03ffb7a4bf0fe654ad310e8a8c34e69b1297ed02ab3a38a989d0712a630e2c41ca52cb76333ef0d400acabd3688a5c2d33621ab24d59027698e444581260403d
+  data.tar.gz: 522d2c9847b0225228d808a053a0eb278d872750883758bc60ccb87128162645fe989d7fa1e14f7fb9384fea69e7fae540dcaf02d4927f1691dc21c1f53223fe

data/app/models/panda_pal/session.rb

@@ -239,24 +239,78 @@ module PandaPal
       labels.is_a?(String) ? labels.split(',') : []
     end
 
-    # Retrieve the User's Role Labels in the specified Account, defaulting to the Root Account
-    def canvas_account_role_labels(account = 'self')
+    # Retrieve the User's Role Labels in the specified Account.
+    #
+    # +account+ accepts an Account-like object (anything responding to
+    # +canvas_id+), a Canvas Account id, or one of:
+    #
+    # [<tt>'self'</tt>] the Account this Tool is installed on (the default).
+    # [<tt>:root</tt>]  a synonym for <tt>'self'</tt>. In an LTI context the
+    #                   installed Account IS the root of everything the Tool can
+    #                   see, and that — deliberately — need not be Canvas's own
+    #                   root Account: a Tool installed on a sub-account has no
+    #                   business reasoning about Accounts above its install.
+    #
+    # With <tt>inherited: true</tt>, roles held on any ANCESTOR of +account+ are
+    # included too, because a Canvas Account Admin administers their Account and
+    # everything beneath it — so an Admin above +account+ genuinely holds that
+    # role over +account+. Off by default: a caller asking "which roles are
+    # granted AT this Account" would not expect inherited ones, so opting in is
+    # explicit, as CanvasSync's +canvas_account_admin?+ does.
+    def canvas_account_role_labels(account = 'self', inherited: false)
       account = 'self' if account.to_s == "root"
       account = account.canvas_id if account.respond_to?(:canvas_id)
 
       if defined?(::Admin) && ::Admin < ::ActiveRecord::Base
-        account = current_organization.canvas_account_id if account == 'self'
-        adm_query = ::Admin.where(canvas_account_id: account, workflow_state: "active", canvas_user_id: canvas_user_id)
+        account = panda_pal_organization.canvas_account_id if account == 'self'
+        accounts = inherited ? canvas_account_ancestry(account) : [account]
+        adm_query = ::Admin.where(canvas_account_id: accounts, workflow_state: "active", canvas_user_id: canvas_user_id)
         adm_query.pluck(:role_name)
       else
-        Rails.cache.fetch([self.class.name, "AccountAdminLinks", account, canvas_user_id], expires_in: 1.hour) do
-          admin_entries = canvas_sync_client.account_admins(account, user_id: [canvas_user_id])
-          admin_entries = admin_entries.select{|ent| ent[:workflow_state] == 'active' }
-          admin_entries.map{|ent| ent[:role] }
+        Rails.cache.fetch([self.class.name, "AccountAdminLinks", account, inherited, canvas_user_id], expires_in: 1.hour) do
+          accounts = inherited ? canvas_account_ancestry(account) : [account]
+          accounts.flat_map { |acct|
+            admin_entries = canvas_sync_client.account_admins(acct, user_id: [canvas_user_id])
+            admin_entries = admin_entries.select{|ent| ent[:workflow_state] == 'active' }
+            admin_entries.map{|ent| ent[:role] }
+          }.uniq
         end
       end
     end
 
+    # +account+ plus every Account above it, nearest first.
+    #
+    # Reads the local Account mirror when the host app has one — no API traffic,
+    # and it works whether or not that model uses the +ancestry+ gem, since only
+    # +canvas_parent_account_id+ is needed. Falls back to walking Canvas.
+    #
+    # Traversal is topological and deliberately does NOT skip deleted Accounts:
+    # dropping one would silently truncate the chain and deny an Admin above it.
+    # Whether a role still counts is decided by the Admin record's own
+    # +workflow_state+, not by the shape of the tree.
+    def canvas_account_ancestry(account)
+      ids = [account]
+      seen = Set.new([account.to_s])
+
+      parent_of =
+        if defined?(::Account) && ::Account < ::ActiveRecord::Base
+          ->(id) { ::Account.find_by(canvas_id: id)&.canvas_parent_account_id }
+        else
+          ->(id) { canvas_sync_client.account(id)[:parent_account_id] }
+        end
+
+      current = account
+      while (parent = parent_of.call(current)).present?
+        break if seen.include?(parent.to_s) # cycle guard — never trust remote topology
+
+        ids << parent
+        seen << parent.to_s
+        current = parent
+      end
+
+      ids
+    end
+
     def lti_roles
       @lti_roles ||= RoleStore.new(launch_params["https://purl.imsglobal.org/spec/lti/claim/roles"] || launch_params['ext_roles'] || '')
     end

data/lib/panda_pal/helpers/controller_helper.rb

@@ -114,7 +114,7 @@ module PandaPal::Helpers
       @current_session.save!
 
       @decoded_lti_jwt = decoded_jwt
-    rescue JSON::JWT::VerificationFailed => e
+    rescue JSON::JWT::Exception => e
       payload = Array(e.message)
 
       render json: {

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.16.21'
+  VERSION = '5.17.0'
 end

data/spec/internal/app/models/account.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# Minimal stand-in for the CanvasSync-generated Account. Present so that
+# Session#canvas_account_ancestry exercises its local-mirror branch (the one
+# host apps actually hit) rather than the Canvas API fallback.
+class Account < ActiveRecord::Base
+end

data/spec/internal/app/models/admin.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Minimal stand-in for the CanvasSync-generated Admin roster model that
+# Session#canvas_account_role_labels reads role labels from.
+class Admin < ActiveRecord::Base
+end

data/spec/internal/db/schema.rb

@@ -3,4 +3,28 @@
 ActiveRecord::Schema.define do
   # Set up any tables you need to exist for your test suite that don't belong
   # in migrations.
+
+  # Stand-ins for the CanvasSync-generated, tenant-scoped models that
+  # Session#canvas_account_role_labels duck-types on. Only the columns it
+  # actually reads are declared. `accounts` deliberately has NO `ancestry`
+  # column: that gem is optional in host apps, so the traversal has to work
+  # from `canvas_parent_account_id` alone.
+  create_table :accounts, force: true do |t|
+    t.bigint :canvas_id, null: false
+    t.bigint :canvas_parent_account_id
+    t.string :name
+    t.string :workflow_state, default: "active"
+    t.timestamps
+  end
+  add_index :accounts, :canvas_id, unique: true
+
+  create_table :admins, force: true do |t|
+    t.bigint :canvas_id
+    t.bigint :canvas_user_id, null: false
+    t.bigint :canvas_account_id, null: false
+    t.string :role_name
+    t.string :workflow_state, default: "active"
+    t.timestamps
+  end
+  add_index :admins, [ :canvas_user_id, :canvas_account_id ]
 end

data/spec/models/panda_pal/session_account_roles_spec.rb

@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+module PandaPal
+  RSpec.describe Session, type: :model do
+    describe '#canvas_account_role_labels' do
+      # The Tool is installed on a SUB-ACCOUNT here, which is the only topology
+      # that distinguishes the install Account from Canvas's own root. A Tool
+      # installed at the top is the degenerate case where every reading of
+      # "root" agrees, so it can't tell a correct implementation from a broken
+      # one.
+      #
+      #   1 root
+      #   └── 20 parent
+      #       └── 300 install   <- current_organization.canvas_account_id
+      #           └── 4000 child
+      #   └── 21 sibling
+      let(:canvas_user_id) { 9001 }
+      let!(:organization) { create(:panda_pal_organization, canvas_account_id: 300) }
+      # Created BEFORE the tenant switch below: panda_pal_sessions lives outside
+      # the tenant schema, while accounts/admins live inside it.
+      let!(:session) do
+        create(:panda_pal_session, panda_pal_organization: organization, data: {
+          launch_params: {
+            "https://purl.imsglobal.org/spec/lti/claim/custom" => { "canvas_user_id" => canvas_user_id },
+          },
+        })
+      end
+
+      def admin!(account_id, role_name: "AccountAdmin", workflow_state: "active")
+        Admin.create!(canvas_user_id: canvas_user_id, canvas_account_id: account_id,
+                      role_name: role_name, workflow_state: workflow_state)
+      end
+
+      before do
+        organization.switch_tenant
+        Account.create!(canvas_id: 1,    canvas_parent_account_id: nil, name: "root")
+        Account.create!(canvas_id: 20,   canvas_parent_account_id: 1,   name: "parent")
+        Account.create!(canvas_id: 21,   canvas_parent_account_id: 1,   name: "sibling")
+        Account.create!(canvas_id: 300,  canvas_parent_account_id: 20,  name: "install")
+        Account.create!(canvas_id: 4000, canvas_parent_account_id: 300, name: "child")
+      end
+
+      after { Apartment::Tenant.reset }
+
+      context 'by default (inherited: false)' do
+        it 'returns roles held at the install Account' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels).to eq(["AccountAdmin"])
+        end
+
+        it 'ignores roles held above the install Account' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels).to eq([])
+        end
+
+        it 'treats :root as the install Account, not as Canvas account 1' do
+          admin!(300, role_name: "Ops")
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(:root)).to eq(["Ops"])
+        end
+
+        it 'reads an explicitly requested Account' do
+          admin!(4000, role_name: "Sub-Account Admin")
+
+          expect(session.canvas_account_role_labels(4000)).to eq(["Sub-Account Admin"])
+        end
+      end
+
+      context 'with inherited: true' do
+        it 'includes a role held on the immediate parent' do
+          admin!(20, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'includes a role held on Canvas\'s root Account, several levels up' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(:root, inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'still includes a role held at the Account itself' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'does NOT include a role held BELOW the Account' do
+          admin!(4000, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'does NOT include a role held on a sibling branch' do
+          admin!(21, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'excludes inactive rows anywhere in the chain' do
+          admin!(1, role_name: "AccountAdmin", workflow_state: "inactive")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'ignores another user\'s roles in the chain' do
+          Admin.create!(canvas_user_id: canvas_user_id + 1, canvas_account_id: 1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'gathers roles from several levels at once' do
+          admin!(300, role_name: "Ops")
+          admin!(20,  role_name: "Department Admin")
+          admin!(1,   role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true))
+            .to contain_exactly("Ops", "Department Admin", "AccountAdmin")
+        end
+
+        it 'walks up from an explicitly requested Account, not from the install' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(4000, inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'accepts an Account-like object' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(Account.find_by(canvas_id: 300), inherited: true))
+            .to eq(["AccountAdmin"])
+        end
+      end
+    end
+
+    describe '#canvas_account_ancestry' do
+      let!(:organization) { create(:panda_pal_organization, canvas_account_id: 300) }
+      let!(:session) { create(:panda_pal_session, panda_pal_organization: organization, data: {}) }
+
+      before { organization.switch_tenant }
+      after { Apartment::Tenant.reset }
+
+      it 'returns the Account plus its ancestors, nearest first' do
+        Account.create!(canvas_id: 1,   canvas_parent_account_id: nil)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 1)
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20, 1 ])
+      end
+
+      it 'returns just the Account when it is already the top' do
+        Account.create!(canvas_id: 1, canvas_parent_account_id: nil)
+
+        expect(session.canvas_account_ancestry(1)).to eq([ 1 ])
+      end
+
+      it 'returns the id unchanged when the Account is not in the local mirror' do
+        expect(session.canvas_account_ancestry(300)).to eq([ 300 ])
+      end
+
+      it 'stops rather than looping forever on a cyclic hierarchy' do
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 300)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20 ])
+      end
+
+      it 'keeps walking through a deleted intermediate Account' do
+        Account.create!(canvas_id: 1,   canvas_parent_account_id: nil)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 1, workflow_state: "deleted")
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20, 1 ])
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.16.21
+  version: 5.17.0
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -202,6 +202,8 @@ files:
 - spec/core/apartment_multidb_spec.rb
 - spec/factories/panda_pal_organizations.rb
 - spec/factories/panda_pal_sessions.rb
+- spec/internal/app/models/account.rb
+- spec/internal/app/models/admin.rb
 - spec/internal/config/database.yml
 - spec/internal/config/routes.rb
 - spec/internal/config/storage.yml
@@ -213,6 +215,7 @@ files:
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
 - spec/models/panda_pal/organization_spec.rb
 - spec/models/panda_pal/platform_spec.rb
+- spec/models/panda_pal/session_account_roles_spec.rb
 - spec/models/panda_pal/session_spec.rb
 - spec/spec_helper.rb
 homepage: http://instructure.com
@@ -243,6 +246,8 @@ test_files:
 - spec/core/apartment_multidb_spec.rb
 - spec/factories/panda_pal_organizations.rb
 - spec/factories/panda_pal_sessions.rb
+- spec/internal/app/models/account.rb
+- spec/internal/app/models/admin.rb
 - spec/internal/config/database.yml
 - spec/internal/config/routes.rb
 - spec/internal/config/storage.yml
@@ -254,5 +259,6 @@ test_files:
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
 - spec/models/panda_pal/organization_spec.rb
 - spec/models/panda_pal/platform_spec.rb
+- spec/models/panda_pal/session_account_roles_spec.rb
 - spec/models/panda_pal/session_spec.rb
 - spec/spec_helper.rb