panda_pal 5.16.21 → 5.17.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a5f35f89d8e121395cef557e6305357a29eab6ea9a63434ec3a38548c92d566
-  data.tar.gz: 6fccf06a199c9c59c01ebb0981cbfb4f86b374303cd7a30521fa0fa604705b9c
+  metadata.gz: 2f32b5b78d11428c9f4be64fc963ae2fac80cae44abfd66dcda0f39be8b17006
+  data.tar.gz: cb494809a3aa72956b16bad0b7b17ba095156a1c4a7fa7261a51738d92442630
 SHA512:
-  metadata.gz: 4b23c1838a9a7b19a8c82d0f57f24d5c2b97ed4d2265379c52832b00ce7fd742bad1388d0697391a594908e2a1dac0f3b65c28cbbf1d2dbe6d1ec3ae6ba2cd68
-  data.tar.gz: 578b81b0921ae8fa4ed8b8bb99ed2c00326fa354c08dc8ff9aca4d354a752aded035aee21658654283369bf29e74eee17b7ba4f900e8ad8fe6594d55ead280fd
+  metadata.gz: 7819962aa331b91ae3b6ad0d95fdb8e5bf314d691cdaa4f120a1f12b199d26c916a811b9f071b9fd73802c8893ae70b6a6158a7ea9457b602f1ea2aa496d4092
+  data.tar.gz: 5cfd2d2f902e658968b3ce2ce2495c5a58e605071db2c97436186b2893f178d2c198856ac42acd9371f6462d108a2a959834958b84ad1fa9d4f9c0740686cc93

data/app/models/panda_pal/session.rb

@@ -9,6 +9,16 @@ module PandaPal
       self.data ||= {}.with_indifferent_access
     end
 
+    # ActiveModel 8.0 skips its own "mark every duped attribute as changed" step
+    # when the source record isn't persisted, and validate_v1p3_launch deletes the
+    # login session before duping it. Under partial_inserts the resulting INSERT
+    # then omits session_secret, which lands NULL and breaks every later
+    # panda_token signature check. Force a full row on every dup.
+    def initialize_dup(other)
+      super
+      attribute_names.each { |name| attribute_will_change!(name) }
+    end
+
     delegate :dig, to: :data
 
     def self.for_request(request, params = request.params, enforce_tenant: true)
@@ -239,22 +249,76 @@ module PandaPal
       labels.is_a?(String) ? labels.split(',') : []
     end
 
-    # Retrieve the User's Role Labels in the specified Account, defaulting to the Root Account
-    def canvas_account_role_labels(account = 'self')
+    # Retrieve the User's Role Labels in the specified Account.
+    #
+    # +account+ accepts an Account-like object (anything responding to
+    # +canvas_id+), a Canvas Account id, or one of:
+    #
+    # [<tt>'self'</tt>] the Account this Tool is installed on (the default).
+    # [<tt>:root</tt>]  a synonym for <tt>'self'</tt>. In an LTI context the
+    #                   installed Account IS the root of everything the Tool can
+    #                   see, and that — deliberately — need not be Canvas's own
+    #                   root Account: a Tool installed on a sub-account has no
+    #                   business reasoning about Accounts above its install.
+    #
+    # With <tt>inherited: true</tt>, roles held on any ANCESTOR of +account+ are
+    # included too, because a Canvas Account Admin administers their Account and
+    # everything beneath it — so an Admin above +account+ genuinely holds that
+    # role over +account+. Off by default: a caller asking "which roles are
+    # granted AT this Account" would not expect inherited ones, so opting in is
+    # explicit, as CanvasSync's +canvas_account_admin?+ does.
+    def canvas_account_role_labels(account = 'self', inherited: false)
       account = 'self' if account.to_s == "root"
       account = account.canvas_id if account.respond_to?(:canvas_id)
 
       if defined?(::Admin) && ::Admin < ::ActiveRecord::Base
-        account = current_organization.canvas_account_id if account == 'self'
-        adm_query = ::Admin.where(canvas_account_id: account, workflow_state: "active", canvas_user_id: canvas_user_id)
+        account = panda_pal_organization.canvas_account_id if account == 'self'
+        accounts = inherited ? canvas_account_ancestry(account) : [account]
+        adm_query = ::Admin.where(canvas_account_id: accounts, workflow_state: "active", canvas_user_id: canvas_user_id)
         adm_query.pluck(:role_name)
       else
-        Rails.cache.fetch([self.class.name, "AccountAdminLinks", account, canvas_user_id], expires_in: 1.hour) do
-          admin_entries = canvas_sync_client.account_admins(account, user_id: [canvas_user_id])
-          admin_entries = admin_entries.select{|ent| ent[:workflow_state] == 'active' }
-          admin_entries.map{|ent| ent[:role] }
+        Rails.cache.fetch([self.class.name, "AccountAdminLinks", account, inherited, canvas_user_id], expires_in: 1.hour) do
+          accounts = inherited ? canvas_account_ancestry(account) : [account]
+          accounts.flat_map { |acct|
+            admin_entries = canvas_sync_client.account_admins(acct, user_id: [canvas_user_id])
+            admin_entries = admin_entries.select{|ent| ent[:workflow_state] == 'active' }
+            admin_entries.map{|ent| ent[:role] }
+          }.uniq
+        end
+      end
+    end
+
+    # +account+ plus every Account above it, nearest first.
+    #
+    # Reads the local Account mirror when the host app has one — no API traffic,
+    # and it works whether or not that model uses the +ancestry+ gem, since only
+    # +canvas_parent_account_id+ is needed. Falls back to walking Canvas.
+    #
+    # Traversal is topological and deliberately does NOT skip deleted Accounts:
+    # dropping one would silently truncate the chain and deny an Admin above it.
+    # Whether a role still counts is decided by the Admin record's own
+    # +workflow_state+, not by the shape of the tree.
+    def canvas_account_ancestry(account)
+      ids = [account]
+      seen = Set.new([account.to_s])
+
+      parent_of =
+        if defined?(::Account) && ::Account < ::ActiveRecord::Base
+          ->(id) { ::Account.find_by(canvas_id: id)&.canvas_parent_account_id }
+        else
+          ->(id) { canvas_sync_client.account(id)[:parent_account_id] }
         end
+
+      current = account
+      while (parent = parent_of.call(current)).present?
+        break if seen.include?(parent.to_s) # cycle guard — never trust remote topology
+
+        ids << parent
+        seen << parent.to_s
+        current = parent
       end
+
+      ids
     end
 
     def lti_roles
@@ -329,7 +393,7 @@ module PandaPal
         ROLE_TYPES.each do |rt|
           # LIS V1
           if role.downcase.start_with?(rt[:urn])
-            return clean_role(ContextTypeURN, role), rt
+            return clean_role(rt[:urn], role), rt
           end
 
           # LIS V2

data/config/initializers/apartment.rb

@@ -50,6 +50,34 @@ module Apartment
       bits[0] = "default" if bits[0].nil? || bits[0].empty?
       bits
     end
+
+    # Lazily switch a long-lived worker thread to `tenant_name` for the duration of the block,
+    # without touching the DB up front. Actively switching checks out a connection and runs
+    # SET search_path even for work that never queries anything, so this only *stages* the
+    # tenant; the ActiveRecord `checkout` hook registered below applies it the moment a
+    # connection is actually acquired, and only then.
+    #
+    # For anything that runs app code on a worker thread outside a normal request/job cycle --
+    # ActionCable's `:work` callback below, CableRoom's `Room#around_work` below, or a similar
+    # hook of your own -- this is the one place that logic lives; call it instead of
+    # reimplementing the stage/release/restore dance yourself.
+    def self.with_lazy_tenant(tenant_name)
+      Thread.current[:cable_tenant] = {
+        adapter: Apartment::Tenant.adapter,
+        tenant: tenant_name,
+      }
+
+      # If this thread already holds a connection from earlier work, release it back to the pool
+      # so the checkout hook below gets a fresh checkout to apply the schema to.
+      pool = Apartment.connection_class.connection_pool
+      pool.release_connection if pool.active_connection?
+
+      Apartment::Tenant.adapter.instance_variable_set(:@current, tenant_name)
+
+      yield
+    ensure
+      Thread.current[:cable_tenant] = nil
+    end
   end
 
   module Adapters
@@ -319,30 +347,10 @@ ActiveSupport.on_load(:action_cable) do
     end
   end
 
-  # Lazily switch any worker threads to the correct tenant when they are working
-  #   Actively calling `switch_tenant` checks out a DB connection and calls `SET search_path`.
-  #   The message processing may not interface with the DB, so this would be a huge waste.
-  #   Instead, we ensure that the thread will trigger a :checkout if it needs a connection,
-  #     at which time we hack-in the correct tenant/schema.
-
+  # Lazily switch any worker threads to the correct tenant when they are working (see
+  # Apartment::Tenant.with_lazy_tenant above for why this is lazy, not an active switch).
   ActionCable::Server::Worker.set_callback :work, :around do |_, blk|
-    # Bit of a hack, but placing this here ensures the adapter is initialized (since such may incur DB calls (requiring a connection)
-    #   which could then cause `checkout` to recurse)
-    Thread.current[:cable_tenant] = {
-      adapter: Apartment::Tenant.adapter,
-      tenant: connection.tenant,
-    }
-
-    # If the current thread already has a connection checked out, release it back to the pool so that the later after_checkout
-    #   callback can set the schema properly.
-    pool = Apartment.connection_class.connection_pool
-    pool.release_connection if pool.active_connection?
-
-    Apartment::Tenant.adapter.instance_variable_set(:@current, connection.tenant)
-
-    blk.call
-  ensure
-    Thread.current[:cable_tenant] = nil
+    Apartment::Tenant.with_lazy_tenant(connection.tenant, &blk)
   end
 
   ActiveSupport.on_load(:active_record) do
@@ -358,6 +366,17 @@ ActiveSupport.on_load(:action_cable) do
   end
 end
 
+# cable_room runs a Room's own code -- message handlers, startup, shutdown, snapshotting -- on a
+# Host worker thread, never inside ActionCable's `:work` callback (its worker pool deliberately
+# isn't an ActionCable::Server::Worker subclass, so it doesn't share that callback chain).
+# `Room#around_work` is its equivalent seam; hook it the same lazy way, on every Room, via
+# CableRoom::Room::Base so every app Room picks it up.
+if defined?(CableRoom)
+  CableRoom::Room::Base.around_work do |room, blk|
+    Apartment::Tenant.with_lazy_tenant(room.tenant, &blk)
+  end
+end
+
 if defined?(Delayed)
   module PandaPal::Plugins
     class ApartmentDelayedJobsPlugin < ::Delayed::Plugin

data/lib/panda_pal/helpers/controller_helper.rb

@@ -114,7 +114,7 @@ module PandaPal::Helpers
       @current_session.save!
 
       @decoded_lti_jwt = decoded_jwt
-    rescue JSON::JWT::VerificationFailed => e
+    rescue JSON::JWT::Exception => e
       payload = Array(e.message)
 
       render json: {

data/lib/panda_pal/helpers/secure_headers.rb

@@ -27,6 +27,10 @@ module PandaPal
         csp_entry(:connect_src, "http://localhost:3035")
         csp_entry(:connect_src, "ws://localhost:3035")
 
+        # Vite dev server
+        csp_entry(:connect_src, "http://localhost:3036")
+        csp_entry(:connect_src, "ws://localhost:3036")
+
         # Allow stuff like rack-mini-profiler to work in development:
         # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
         csp_entry(:script_src, "'unsafe-eval'")

data/lib/panda_pal/helpers/session_replacement.rb

@@ -129,21 +129,23 @@ module PandaPal::Helpers
       type = type.to_s.downcase
       type = type[2..] if type.start_with?('t-')
 
+      base_payload = {
+        v: 1,
+        o: current_organization.id,
+        s: current_session.id,
+      }
+
       if type == 'url'
         raise StandardError, "URL is required" unless url.present?
         to_sign = PandaPal::Session.format_url_for_signing(url)
-        payload.merge!(
+        payload = base_payload.merge(
           typ: 'T-URI',
           usig: current_session.sign_value(to_sign),
         )
       else
         @cached_link_nonces ||= {}
-        @cached_link_nonces[type] ||= begin
-          payload = {
-            v: 1,
-            o: current_organization.id,
-            s: current_session.id,
-          }
+        payload = @cached_link_nonces[type] ||= begin
+          payload = base_payload.dup
 
           if type == 'nonce'
             current_session[:link_nonce] = SecureRandom.hex

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.16.21'
+  VERSION = '5.17.1'
 end

data/spec/internal/app/models/account.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# Minimal stand-in for the CanvasSync-generated Account. Present so that
+# Session#canvas_account_ancestry exercises its local-mirror branch (the one
+# host apps actually hit) rather than the Canvas API fallback.
+class Account < ActiveRecord::Base
+end

data/spec/internal/app/models/admin.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Minimal stand-in for the CanvasSync-generated Admin roster model that
+# Session#canvas_account_role_labels reads role labels from.
+class Admin < ActiveRecord::Base
+end

data/spec/internal/db/schema.rb

@@ -3,4 +3,28 @@
 ActiveRecord::Schema.define do
   # Set up any tables you need to exist for your test suite that don't belong
   # in migrations.
+
+  # Stand-ins for the CanvasSync-generated, tenant-scoped models that
+  # Session#canvas_account_role_labels duck-types on. Only the columns it
+  # actually reads are declared. `accounts` deliberately has NO `ancestry`
+  # column: that gem is optional in host apps, so the traversal has to work
+  # from `canvas_parent_account_id` alone.
+  create_table :accounts, force: true do |t|
+    t.bigint :canvas_id, null: false
+    t.bigint :canvas_parent_account_id
+    t.string :name
+    t.string :workflow_state, default: "active"
+    t.timestamps
+  end
+  add_index :accounts, :canvas_id, unique: true
+
+  create_table :admins, force: true do |t|
+    t.bigint :canvas_id
+    t.bigint :canvas_user_id, null: false
+    t.bigint :canvas_account_id, null: false
+    t.string :role_name
+    t.string :workflow_state, default: "active"
+    t.timestamps
+  end
+  add_index :admins, [ :canvas_user_id, :canvas_account_id ]
 end

data/spec/lib/panda_pal/helpers/session_replacement_spec.rb

@@ -0,0 +1,72 @@
+require 'spec_helper'
+
+RSpec.describe PandaPal::Helpers::SessionReplacement do
+  let(:organization) { create(:panda_pal_organization) }
+  let(:session) { PandaPal::Session.create!(panda_pal_organization: organization, data: {}) }
+
+  let(:host_class) do
+    Class.new do
+      # Stub the concern's controller-only class macros.
+      def self.helper_method(*args); end
+      def self.prepend_around_action(*args); end
+
+      include PandaPal::Helpers::SessionReplacement
+
+      attr_reader :current_organization, :current_session
+
+      def initialize(organization, session)
+        @current_organization = organization
+        @current_session = session
+      end
+
+      def request
+        @request ||= Struct.new(:remote_ip).new('127.0.0.1')
+      end
+    end
+  end
+
+  subject(:controller) { host_class.new(organization, session) }
+
+  def decoded_payload(token)
+    JSON.parse(Base64.urlsafe_decode64(token.split('.').first))
+  end
+
+  describe '#link_nonce' do
+    it 'returns the same real payload on repeated calls within one request' do
+      first = controller.link_nonce(type: :nonce)
+      second = controller.link_nonce(type: :nonce)
+      third = controller.link_nonce(type: :nonce)
+
+      [first, second, third].each do |token|
+        expect(token.split('.').first).not_to eq(Base64.urlsafe_encode64('null'))
+        payload = decoded_payload(token)
+        expect(payload['typ']).to eq('T-NONCE')
+        expect(payload['o']).to eq(organization.id)
+        expect(payload['s']).to eq(session.id)
+        expect(payload['nnc']).to be_present
+      end
+
+      expect(second).to eq(first)
+      expect(third).to eq(first)
+    end
+
+    it 'builds a T-URI payload with the org and session the verifier requires' do
+      token = controller.link_nonce('https://example.test/a/b', type: :url)
+
+      payload = decoded_payload(token)
+      expect(payload['typ']).to eq('T-URI')
+      expect(payload['o']).to eq(organization.id)
+      expect(payload['s']).to eq(session.id)
+      expect(payload['usig']).to be_present
+    end
+
+    it 'still caches one nonce per type per request rather than rotating it' do
+      controller.link_nonce(type: :nonce)
+      nonce_after_first = session[:link_nonce]
+
+      controller.link_nonce(type: :nonce)
+
+      expect(session[:link_nonce]).to eq(nonce_after_first)
+    end
+  end
+end

data/spec/models/panda_pal/session_account_roles_spec.rb

@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+module PandaPal
+  RSpec.describe Session, type: :model do
+    describe '#canvas_account_role_labels' do
+      # The Tool is installed on a SUB-ACCOUNT here, which is the only topology
+      # that distinguishes the install Account from Canvas's own root. A Tool
+      # installed at the top is the degenerate case where every reading of
+      # "root" agrees, so it can't tell a correct implementation from a broken
+      # one.
+      #
+      #   1 root
+      #   └── 20 parent
+      #       └── 300 install   <- current_organization.canvas_account_id
+      #           └── 4000 child
+      #   └── 21 sibling
+      let(:canvas_user_id) { 9001 }
+      let!(:organization) { create(:panda_pal_organization, canvas_account_id: 300) }
+      # Created BEFORE the tenant switch below: panda_pal_sessions lives outside
+      # the tenant schema, while accounts/admins live inside it.
+      let!(:session) do
+        create(:panda_pal_session, panda_pal_organization: organization, data: {
+          launch_params: {
+            "https://purl.imsglobal.org/spec/lti/claim/custom" => { "canvas_user_id" => canvas_user_id },
+          },
+        })
+      end
+
+      def admin!(account_id, role_name: "AccountAdmin", workflow_state: "active")
+        Admin.create!(canvas_user_id: canvas_user_id, canvas_account_id: account_id,
+                      role_name: role_name, workflow_state: workflow_state)
+      end
+
+      before do
+        organization.switch_tenant
+        Account.create!(canvas_id: 1,    canvas_parent_account_id: nil, name: "root")
+        Account.create!(canvas_id: 20,   canvas_parent_account_id: 1,   name: "parent")
+        Account.create!(canvas_id: 21,   canvas_parent_account_id: 1,   name: "sibling")
+        Account.create!(canvas_id: 300,  canvas_parent_account_id: 20,  name: "install")
+        Account.create!(canvas_id: 4000, canvas_parent_account_id: 300, name: "child")
+      end
+
+      after { Apartment::Tenant.reset }
+
+      context 'by default (inherited: false)' do
+        it 'returns roles held at the install Account' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels).to eq(["AccountAdmin"])
+        end
+
+        it 'ignores roles held above the install Account' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels).to eq([])
+        end
+
+        it 'treats :root as the install Account, not as Canvas account 1' do
+          admin!(300, role_name: "Ops")
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(:root)).to eq(["Ops"])
+        end
+
+        it 'reads an explicitly requested Account' do
+          admin!(4000, role_name: "Sub-Account Admin")
+
+          expect(session.canvas_account_role_labels(4000)).to eq(["Sub-Account Admin"])
+        end
+      end
+
+      context 'with inherited: true' do
+        it 'includes a role held on the immediate parent' do
+          admin!(20, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'includes a role held on Canvas\'s root Account, several levels up' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(:root, inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'still includes a role held at the Account itself' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'does NOT include a role held BELOW the Account' do
+          admin!(4000, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'does NOT include a role held on a sibling branch' do
+          admin!(21, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'excludes inactive rows anywhere in the chain' do
+          admin!(1, role_name: "AccountAdmin", workflow_state: "inactive")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'ignores another user\'s roles in the chain' do
+          Admin.create!(canvas_user_id: canvas_user_id + 1, canvas_account_id: 1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
+        end
+
+        it 'gathers roles from several levels at once' do
+          admin!(300, role_name: "Ops")
+          admin!(20,  role_name: "Department Admin")
+          admin!(1,   role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(inherited: true))
+            .to contain_exactly("Ops", "Department Admin", "AccountAdmin")
+        end
+
+        it 'walks up from an explicitly requested Account, not from the install' do
+          admin!(300, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(4000, inherited: true)).to eq(["AccountAdmin"])
+        end
+
+        it 'accepts an Account-like object' do
+          admin!(1, role_name: "AccountAdmin")
+
+          expect(session.canvas_account_role_labels(Account.find_by(canvas_id: 300), inherited: true))
+            .to eq(["AccountAdmin"])
+        end
+      end
+    end
+
+    describe '#canvas_account_ancestry' do
+      let!(:organization) { create(:panda_pal_organization, canvas_account_id: 300) }
+      let!(:session) { create(:panda_pal_session, panda_pal_organization: organization, data: {}) }
+
+      before { organization.switch_tenant }
+      after { Apartment::Tenant.reset }
+
+      it 'returns the Account plus its ancestors, nearest first' do
+        Account.create!(canvas_id: 1,   canvas_parent_account_id: nil)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 1)
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20, 1 ])
+      end
+
+      it 'returns just the Account when it is already the top' do
+        Account.create!(canvas_id: 1, canvas_parent_account_id: nil)
+
+        expect(session.canvas_account_ancestry(1)).to eq([ 1 ])
+      end
+
+      it 'returns the id unchanged when the Account is not in the local mirror' do
+        expect(session.canvas_account_ancestry(300)).to eq([ 300 ])
+      end
+
+      it 'stops rather than looping forever on a cyclic hierarchy' do
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 300)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20 ])
+      end
+
+      it 'keeps walking through a deleted intermediate Account' do
+        Account.create!(canvas_id: 1,   canvas_parent_account_id: nil)
+        Account.create!(canvas_id: 20,  canvas_parent_account_id: 1, workflow_state: "deleted")
+        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
+
+        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20, 1 ])
+      end
+    end
+  end
+end

data/spec/models/panda_pal/session_spec.rb

@@ -6,6 +6,53 @@ module PandaPal
       expect(PandaPal::Session.new.session_secret).to_not be_nil
     end
 
+    describe '#dup' do
+      # Mirrors validate_v1p3_launch: load the login session, delete it, dup it into
+      # the org's tenant. Only fails on Rails 8.0 with partial_inserts left on, so it
+      # is the appraisal run that gates this, not the default (Rails 8.1) lockfile.
+      it 'persists every attribute, including session_secret, on the duped record' do
+        original = PandaPal::Session.find(create(:panda_pal_session).id)
+        original_secret = original.session_secret
+        original.delete
+
+        with_partial_inserts(true) do
+          duped = original.dup
+          duped.save!
+
+          reloaded = PandaPal::Session.find(duped.id)
+          expect(reloaded.session_secret).to eq(original_secret)
+        end
+      end
+
+      # Rails 7.0 split partial_writes into partial_inserts/partial_updates; on 6.1
+      # the single partial_writes flag is what controls the INSERT.
+      def with_partial_inserts(value)
+        setting = PandaPal::Session.respond_to?(:partial_inserts) ? 'partial_inserts' : 'partial_writes'
+        previous = PandaPal::Session.public_send(setting)
+        PandaPal::Session.public_send("#{setting}=", value)
+        yield
+      ensure
+        PandaPal::Session.public_send("#{setting}=", previous) unless previous.nil?
+      end
+    end
+
+    describe Session::RoleStore do
+      it 'parses an LTI 1.1 (URN-style) institution role' do
+        role_store = Session::RoleStore.new('urn:lti:instrole:ims/lis/Administrator')
+        expect(role_store.institution_roles).to eq(['administrator'])
+      end
+
+      it 'parses an LTI 1.1 (URN-style) system role' do
+        role_store = Session::RoleStore.new('urn:lti:sysrole:ims/lis/SysAdmin')
+        expect(role_store.system_roles).to eq(['sys_admin'])
+      end
+
+      it 'parses an LTI 1.3 (URL-style) institution role' do
+        role_store = Session::RoleStore.new(['http://purl.imsglobal.org/vocab/lis/v2/institution/person#Administrator'])
+        expect(role_store.institution_roles).to eq(['administrator'])
+      end
+    end
+
     describe '.for_panda_token' do
       it 'returns nil for a nil token' do
         expect(Session.for_panda_token(nil)).to be_nil

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.16.21
+  version: 5.17.1
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -202,17 +202,21 @@ files:
 - spec/core/apartment_multidb_spec.rb
 - spec/factories/panda_pal_organizations.rb
 - spec/factories/panda_pal_sessions.rb
+- spec/internal/app/models/account.rb
+- spec/internal/app/models/admin.rb
 - spec/internal/config/database.yml
 - spec/internal/config/routes.rb
 - spec/internal/config/storage.yml
 - spec/internal/db/schema.rb
 - spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
 - spec/lib/panda_pal/helpers/secure_headers_spec.rb
+- spec/lib/panda_pal/helpers/session_replacement_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
 - spec/models/panda_pal/organization/settings_validation_spec.rb
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
 - spec/models/panda_pal/organization_spec.rb
 - spec/models/panda_pal/platform_spec.rb
+- spec/models/panda_pal/session_account_roles_spec.rb
 - spec/models/panda_pal/session_spec.rb
 - spec/spec_helper.rb
 homepage: http://instructure.com
@@ -243,16 +247,20 @@ test_files:
 - spec/core/apartment_multidb_spec.rb
 - spec/factories/panda_pal_organizations.rb
 - spec/factories/panda_pal_sessions.rb
+- spec/internal/app/models/account.rb
+- spec/internal/app/models/admin.rb
 - spec/internal/config/database.yml
 - spec/internal/config/routes.rb
 - spec/internal/config/storage.yml
 - spec/internal/db/schema.rb
 - spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
 - spec/lib/panda_pal/helpers/secure_headers_spec.rb
+- spec/lib/panda_pal/helpers/session_replacement_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
 - spec/models/panda_pal/organization/settings_validation_spec.rb
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
 - spec/models/panda_pal/organization_spec.rb
 - spec/models/panda_pal/platform_spec.rb
+- spec/models/panda_pal/session_account_roles_spec.rb
 - spec/models/panda_pal/session_spec.rb
 - spec/spec_helper.rb