panda_pal 5.17.0 → 5.17.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aa9bee5cce120a4bf340d69ebd142e6f11f8d65bb0b4d850bb781662469ba84e
-  data.tar.gz: b1040ec6ecbd33c7ff5fe0eef396a2e5d1764ec893a1c439b5cd8de0ec7d726c
+  metadata.gz: 1d2cfdbfc9d2c60cc080b545d2ee582ce212623a45c286d8610b8ac5f6c1af37
+  data.tar.gz: 4918d3bee6808bfbf22e98e23f3cbedcd493d4ec7c946ac67e0c8ca5485d9eca
 SHA512:
-  metadata.gz: 03ffb7a4bf0fe654ad310e8a8c34e69b1297ed02ab3a38a989d0712a630e2c41ca52cb76333ef0d400acabd3688a5c2d33621ab24d59027698e444581260403d
-  data.tar.gz: 522d2c9847b0225228d808a053a0eb278d872750883758bc60ccb87128162645fe989d7fa1e14f7fb9384fea69e7fae540dcaf02d4927f1691dc21c1f53223fe
+  metadata.gz: 0e06e419047c6a29e1ed8f03966bae4c31ed9e5b57ad6953133b890f6dab407d384ea1f071e0c88e01f7a69ef790f9b132f98a973aa3602b6b902d4871722799
+  data.tar.gz: 6d19e0a9ea13914f8045d62525dd73dcb97aadfc780dc1c4907fe3b80df9483144d1cc3cc087d509aa7cfba344aa64aaa4b7bd36b05fea354201d7e387094db4

data/app/models/panda_pal/session.rb

@@ -9,6 +9,16 @@ module PandaPal
       self.data ||= {}.with_indifferent_access
     end
 
+    # ActiveModel 8.0 skips its own "mark every duped attribute as changed" step
+    # when the source record isn't persisted, and validate_v1p3_launch deletes the
+    # login session before duping it. Under partial_inserts the resulting INSERT
+    # then omits session_secret, which lands NULL and breaks every later
+    # panda_token signature check. Force a full row on every dup.
+    def initialize_dup(other)
+      super
+      attribute_names.each { |name| attribute_will_change!(name) }
+    end
+
     delegate :dig, to: :data
 
     def self.for_request(request, params = request.params, enforce_tenant: true)
@@ -383,7 +393,7 @@ module PandaPal
         ROLE_TYPES.each do |rt|
           # LIS V1
           if role.downcase.start_with?(rt[:urn])
-            return clean_role(ContextTypeURN, role), rt
+            return clean_role(rt[:urn], role), rt
           end
 
           # LIS V2

data/config/initializers/apartment.rb

@@ -50,6 +50,34 @@ module Apartment
       bits[0] = "default" if bits[0].nil? || bits[0].empty?
       bits
     end
+
+    # Lazily switch a long-lived worker thread to `tenant_name` for the duration of the block,
+    # without touching the DB up front. Actively switching checks out a connection and runs
+    # SET search_path even for work that never queries anything, so this only *stages* the
+    # tenant; the ActiveRecord `checkout` hook registered below applies it the moment a
+    # connection is actually acquired, and only then.
+    #
+    # For anything that runs app code on a worker thread outside a normal request/job cycle --
+    # ActionCable's `:work` callback below, CableRoom's `Room#around_work` below, or a similar
+    # hook of your own -- this is the one place that logic lives; call it instead of
+    # reimplementing the stage/release/restore dance yourself.
+    def self.with_lazy_tenant(tenant_name)
+      Thread.current[:cable_tenant] = {
+        adapter: Apartment::Tenant.adapter,
+        tenant: tenant_name,
+      }
+
+      # If this thread already holds a connection from earlier work, release it back to the pool
+      # so the checkout hook below gets a fresh checkout to apply the schema to.
+      pool = Apartment.connection_class.connection_pool
+      pool.release_connection if pool.active_connection?
+
+      Apartment::Tenant.adapter.instance_variable_set(:@current, tenant_name)
+
+      yield
+    ensure
+      Thread.current[:cable_tenant] = nil
+    end
   end
 
   module Adapters
@@ -120,10 +148,7 @@ module Apartment
 
         raise ActiveRecord::StatementInvalid, "PandaPal/Apartment Mutli-DB support does not currently support DB roles" if ActiveRecord::Base.current_role != ActiveRecord::Base.default_role
 
-        unless ActiveRecord::Base.connected?
-          Apartment.establish_connection multi_tenantify(tenant, false)
-          Apartment.connection.verify!
-        end
+        establish_connection_pool(tenant) unless connection_pool_registered?
 
         Apartment.connection.enable_query_cache! if query_cache_enabled
 
@@ -143,6 +168,25 @@ module Apartment
 
       protected
 
+      ESTABLISH_CONNECTION_LOCK = Mutex.new
+
+      def connection_pool_registered?
+        !ActiveRecord::Base.connection_handler.retrieve_connection_pool(
+          ActiveRecord::Base.connection_specification_name,
+          role: ActiveRecord::Base.current_role,
+          shard: ActiveRecord::Base.current_shard,
+        ).nil?
+      end
+
+      def establish_connection_pool(tenant)
+        ESTABLISH_CONNECTION_LOCK.synchronize do
+          next if connection_pool_registered?
+
+          Apartment.establish_connection multi_tenantify(tenant, false)
+          Apartment.connection.verify!
+        end
+      end
+
       def persistent_schemas
         map_to_schemas(super)
       end
@@ -319,30 +363,10 @@ ActiveSupport.on_load(:action_cable) do
     end
   end
 
-  # Lazily switch any worker threads to the correct tenant when they are working
-  #   Actively calling `switch_tenant` checks out a DB connection and calls `SET search_path`.
-  #   The message processing may not interface with the DB, so this would be a huge waste.
-  #   Instead, we ensure that the thread will trigger a :checkout if it needs a connection,
-  #     at which time we hack-in the correct tenant/schema.
-
+  # Lazily switch any worker threads to the correct tenant when they are working (see
+  # Apartment::Tenant.with_lazy_tenant above for why this is lazy, not an active switch).
   ActionCable::Server::Worker.set_callback :work, :around do |_, blk|
-    # Bit of a hack, but placing this here ensures the adapter is initialized (since such may incur DB calls (requiring a connection)
-    #   which could then cause `checkout` to recurse)
-    Thread.current[:cable_tenant] = {
-      adapter: Apartment::Tenant.adapter,
-      tenant: connection.tenant,
-    }
-
-    # If the current thread already has a connection checked out, release it back to the pool so that the later after_checkout
-    #   callback can set the schema properly.
-    pool = Apartment.connection_class.connection_pool
-    pool.release_connection if pool.active_connection?
-
-    Apartment::Tenant.adapter.instance_variable_set(:@current, connection.tenant)
-
-    blk.call
-  ensure
-    Thread.current[:cable_tenant] = nil
+    Apartment::Tenant.with_lazy_tenant(connection.tenant, &blk)
   end
 
   ActiveSupport.on_load(:active_record) do
@@ -358,6 +382,17 @@ ActiveSupport.on_load(:action_cable) do
   end
 end
 
+# cable_room runs a Room's own code -- message handlers, startup, shutdown, snapshotting -- on a
+# Host worker thread, never inside ActionCable's `:work` callback (its worker pool deliberately
+# isn't an ActionCable::Server::Worker subclass, so it doesn't share that callback chain).
+# `Room#around_work` is its equivalent seam; hook it the same lazy way, on every Room, via
+# CableRoom::Room::Base so every app Room picks it up.
+if defined?(CableRoom)
+  CableRoom::Room::Base.around_work do |room, blk|
+    Apartment::Tenant.with_lazy_tenant(room.tenant, &blk)
+  end
+end
+
 if defined?(Delayed)
   module PandaPal::Plugins
     class ApartmentDelayedJobsPlugin < ::Delayed::Plugin

data/lib/panda_pal/helpers/secure_headers.rb

@@ -27,6 +27,10 @@ module PandaPal
         csp_entry(:connect_src, "http://localhost:3035")
         csp_entry(:connect_src, "ws://localhost:3035")
 
+        # Vite dev server
+        csp_entry(:connect_src, "http://localhost:3036")
+        csp_entry(:connect_src, "ws://localhost:3036")
+
         # Allow stuff like rack-mini-profiler to work in development:
         # https://github.com/MiniProfiler/rack-mini-profiler/issues/327
         csp_entry(:script_src, "'unsafe-eval'")

data/lib/panda_pal/helpers/session_replacement.rb

@@ -129,21 +129,23 @@ module PandaPal::Helpers
       type = type.to_s.downcase
       type = type[2..] if type.start_with?('t-')
 
+      base_payload = {
+        v: 1,
+        o: current_organization.id,
+        s: current_session.id,
+      }
+
       if type == 'url'
         raise StandardError, "URL is required" unless url.present?
         to_sign = PandaPal::Session.format_url_for_signing(url)
-        payload.merge!(
+        payload = base_payload.merge(
           typ: 'T-URI',
           usig: current_session.sign_value(to_sign),
         )
       else
         @cached_link_nonces ||= {}
-        @cached_link_nonces[type] ||= begin
-          payload = {
-            v: 1,
-            o: current_organization.id,
-            s: current_session.id,
-          }
+        payload = @cached_link_nonces[type] ||= begin
+          payload = base_payload.dup
 
           if type == 'nonce'
             current_session[:link_nonce] = SecureRandom.hex

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.17.0'
+  VERSION = '5.17.2'
 end

data/spec/core/apartment_multidb_spec.rb

@@ -53,6 +53,72 @@ RSpec.describe PandaPal::Organization, type: :model do
       expect(PandaPal::ApiCall.connection.exec_query("SELECT current_database()").pluck("current_database")[0]).to eq("panda_pal_test2")
     end
 
+    context "connection pool lifecycle" do
+      def alt_pool
+        ActiveRecord::Base.connection_handler.retrieve_connection_pool(
+          ActiveRecord::Base.connection_specification_name,
+          role: ActiveRecord::Base.current_role,
+          shard: "apt:alt",
+        )
+      end
+
+      def count_establish_connection_calls
+        calls = Queue.new
+        allow(Apartment).to receive(:establish_connection).and_wrap_original do |original, *args, **kwargs|
+          calls << true
+          original.call(*args, **kwargs)
+        end
+        yield
+        calls.size
+      end
+
+      def switch_in_threads(tenant, count)
+        start = Queue.new
+        threads = count.times.map do
+          Thread.new do
+            start.pop
+            Apartment::Tenant.switch(tenant) { PandaPal::ApiCall.count }
+          ensure
+            ActiveRecord::Base.connection_handler.clear_active_connections!
+          end
+        end
+        count.times { start << true }
+        threads.map(&:value)
+      end
+
+      it "reuses an existing shard pool whose connections have all been closed" do
+        org2.switch_tenant { PandaPal::ApiCall.count }
+        pool = alt_pool
+        ActiveRecord::Base.connection_handler.clear_active_connections!
+        pool.disconnect!
+
+        calls = count_establish_connection_calls do
+          org2.switch_tenant { expect(PandaPal::ApiCall.count).to eq(0) }
+        end
+
+        expect(calls).to eq(0)
+        expect(alt_pool).to equal(pool)
+      end
+
+      it "establishes a missing shard pool once when many threads need it at the same time" do
+        org2.switch_tenant { PandaPal::ApiCall.count }
+        ActiveRecord::Base.connection_handler.clear_active_connections!
+        ActiveRecord::Base.connection_handler.remove_connection_pool(
+          ActiveRecord::Base.connection_specification_name,
+          role: ActiveRecord::Base.current_role,
+          shard: "apt:alt",
+        )
+
+        results = nil
+        calls = count_establish_connection_calls do
+          results = switch_in_threads("alt:on_alt", 8)
+        end
+
+        expect(results).to eq([0] * 8)
+        expect(calls).to eq(1)
+      end
+    end
+
     # load_async is a Rails 7.0+ feature.
     context "load_async", skip: (ActiveRecord::Relation.method_defined?(:load_async) ? false : "requires Rails 7.0+ load_async") do
       it "works across shards" do

data/spec/lib/panda_pal/helpers/session_replacement_spec.rb

@@ -0,0 +1,72 @@
+require 'spec_helper'
+
+RSpec.describe PandaPal::Helpers::SessionReplacement do
+  let(:organization) { create(:panda_pal_organization) }
+  let(:session) { PandaPal::Session.create!(panda_pal_organization: organization, data: {}) }
+
+  let(:host_class) do
+    Class.new do
+      # Stub the concern's controller-only class macros.
+      def self.helper_method(*args); end
+      def self.prepend_around_action(*args); end
+
+      include PandaPal::Helpers::SessionReplacement
+
+      attr_reader :current_organization, :current_session
+
+      def initialize(organization, session)
+        @current_organization = organization
+        @current_session = session
+      end
+
+      def request
+        @request ||= Struct.new(:remote_ip).new('127.0.0.1')
+      end
+    end
+  end
+
+  subject(:controller) { host_class.new(organization, session) }
+
+  def decoded_payload(token)
+    JSON.parse(Base64.urlsafe_decode64(token.split('.').first))
+  end
+
+  describe '#link_nonce' do
+    it 'returns the same real payload on repeated calls within one request' do
+      first = controller.link_nonce(type: :nonce)
+      second = controller.link_nonce(type: :nonce)
+      third = controller.link_nonce(type: :nonce)
+
+      [first, second, third].each do |token|
+        expect(token.split('.').first).not_to eq(Base64.urlsafe_encode64('null'))
+        payload = decoded_payload(token)
+        expect(payload['typ']).to eq('T-NONCE')
+        expect(payload['o']).to eq(organization.id)
+        expect(payload['s']).to eq(session.id)
+        expect(payload['nnc']).to be_present
+      end
+
+      expect(second).to eq(first)
+      expect(third).to eq(first)
+    end
+
+    it 'builds a T-URI payload with the org and session the verifier requires' do
+      token = controller.link_nonce('https://example.test/a/b', type: :url)
+
+      payload = decoded_payload(token)
+      expect(payload['typ']).to eq('T-URI')
+      expect(payload['o']).to eq(organization.id)
+      expect(payload['s']).to eq(session.id)
+      expect(payload['usig']).to be_present
+    end
+
+    it 'still caches one nonce per type per request rather than rotating it' do
+      controller.link_nonce(type: :nonce)
+      nonce_after_first = session[:link_nonce]
+
+      controller.link_nonce(type: :nonce)
+
+      expect(session[:link_nonce]).to eq(nonce_after_first)
+    end
+  end
+end

data/spec/models/panda_pal/session_spec.rb

@@ -6,6 +6,53 @@ module PandaPal
       expect(PandaPal::Session.new.session_secret).to_not be_nil
     end
 
+    describe '#dup' do
+      # Mirrors validate_v1p3_launch: load the login session, delete it, dup it into
+      # the org's tenant. Only fails on Rails 8.0 with partial_inserts left on, so it
+      # is the appraisal run that gates this, not the default (Rails 8.1) lockfile.
+      it 'persists every attribute, including session_secret, on the duped record' do
+        original = PandaPal::Session.find(create(:panda_pal_session).id)
+        original_secret = original.session_secret
+        original.delete
+
+        with_partial_inserts(true) do
+          duped = original.dup
+          duped.save!
+
+          reloaded = PandaPal::Session.find(duped.id)
+          expect(reloaded.session_secret).to eq(original_secret)
+        end
+      end
+
+      # Rails 7.0 split partial_writes into partial_inserts/partial_updates; on 6.1
+      # the single partial_writes flag is what controls the INSERT.
+      def with_partial_inserts(value)
+        setting = PandaPal::Session.respond_to?(:partial_inserts) ? 'partial_inserts' : 'partial_writes'
+        previous = PandaPal::Session.public_send(setting)
+        PandaPal::Session.public_send("#{setting}=", value)
+        yield
+      ensure
+        PandaPal::Session.public_send("#{setting}=", previous) unless previous.nil?
+      end
+    end
+
+    describe Session::RoleStore do
+      it 'parses an LTI 1.1 (URN-style) institution role' do
+        role_store = Session::RoleStore.new('urn:lti:instrole:ims/lis/Administrator')
+        expect(role_store.institution_roles).to eq(['administrator'])
+      end
+
+      it 'parses an LTI 1.1 (URN-style) system role' do
+        role_store = Session::RoleStore.new('urn:lti:sysrole:ims/lis/SysAdmin')
+        expect(role_store.system_roles).to eq(['sys_admin'])
+      end
+
+      it 'parses an LTI 1.3 (URL-style) institution role' do
+        role_store = Session::RoleStore.new(['http://purl.imsglobal.org/vocab/lis/v2/institution/person#Administrator'])
+        expect(role_store.institution_roles).to eq(['administrator'])
+      end
+    end
+
     describe '.for_panda_token' do
       it 'returns nil for a nil token' do
         expect(Session.for_panda_token(nil)).to be_nil

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.17.0
+  version: 5.17.2
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -210,6 +210,7 @@ files:
 - spec/internal/db/schema.rb
 - spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
 - spec/lib/panda_pal/helpers/secure_headers_spec.rb
+- spec/lib/panda_pal/helpers/session_replacement_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
 - spec/models/panda_pal/organization/settings_validation_spec.rb
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
@@ -254,6 +255,7 @@ test_files:
 - spec/internal/db/schema.rb
 - spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
 - spec/lib/panda_pal/helpers/secure_headers_spec.rb
+- spec/lib/panda_pal/helpers/session_replacement_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
 - spec/models/panda_pal/organization/settings_validation_spec.rb
 - spec/models/panda_pal/organization/task_scheduling_spec.rb