panda_pal 5.17.1 → 5.18.0

data/spec/models/panda_pal/platform_spec.rb

@@ -148,5 +148,202 @@ module PandaPal
         expect(restored.jwks_url).to eq(platform.jwks_url)
       end
     end
+    describe 'LTI Advantage service tokens' do
+      let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
+      let(:platform) { Platform::Canvas.new(iss: 'https://canvas.instructure.com') }
+      let(:grant_url) { 'https://sso.canvaslms.com/login/oauth2/token' }
+      let(:client_id) { '10000000000042' }
+      let(:score_scope) { LtiConstants::AgsScopes::SCORE }
+      let(:cache) { ActiveSupport::Cache::MemoryStore.new }
+
+      before do
+        PandaPal.lti_private_key = rsa_key
+        PandaPal.jwk = nil
+        allow(Rails).to receive(:cache).and_return(cache)
+      end
+
+      after do
+        PandaPal.lti_private_key = nil
+        PandaPal.jwk = nil
+      end
+
+      def http_response(code, body = '', headers = {})
+        double('HTTParty::Response', code: code, success?: (200..299).cover?(code), body: body, headers: headers)
+      end
+
+      def token_response(token, expires_in: 3600)
+        http_response(200, { access_token: token, token_type: 'Bearer', expires_in: expires_in }.to_json)
+      end
+
+      describe '#service_access_token' do
+        it 'posts a client_credentials grant with an RS256 client assertion signed by the tool key' do
+          captured = nil
+          allow(HTTParty).to receive(:post) do |url, **options|
+            captured = { url: url, options: options }
+            token_response('service-token')
+          end
+
+          token = platform.service_access_token(client_id: client_id, scopes: [score_scope])
+
+          expect(token).to eq('service-token')
+          expect(captured[:url]).to eq(grant_url)
+
+          body = captured[:options][:body]
+          expect(body[:grant_type]).to eq('client_credentials')
+          expect(body[:client_assertion_type]).to eq('urn:ietf:params:oauth:client-assertion-type:jwt-bearer')
+          expect(body[:scope]).to eq(score_scope)
+
+          payload, header = JWT.decode(body[:client_assertion], rsa_key.public_key, true, algorithm: 'RS256')
+          expect(header['alg']).to eq('RS256')
+          expect(header['kid']).to eq(PandaPal.jwk.kid)
+          expect(payload['iss']).to eq(client_id)
+          expect(payload['sub']).to eq(client_id)
+          expect(payload['aud']).to eq(grant_url)
+          expect(payload['jti']).to be_present
+          expect(payload['exp'] - payload['iat']).to eq(300)
+          expect(payload['iat']).to be_within(5).of(Time.now.to_i)
+        end
+
+        it 'joins several scopes with spaces' do
+          expect(HTTParty).to receive(:post).with(grant_url, hash_including(
+            body: hash_including(scope: [LtiConstants::AgsScopes::LINEITEM_READONLY, score_scope].sort.join(' '))
+          )).and_return(token_response('service-token'))
+
+          platform.service_access_token(client_id: client_id, scopes: [score_scope, LtiConstants::AgsScopes::LINEITEM_READONLY])
+        end
+
+        it 'bounds the request with timeouts' do
+          expect(HTTParty).to receive(:post).with(grant_url, hash_including(open_timeout: 5, read_timeout: 15))
+            .and_return(token_response('service-token'))
+
+          platform.service_access_token(client_id: client_id, scopes: [score_scope])
+        end
+
+        it 'reuses the cached token for the same client and scopes' do
+          expect(HTTParty).to receive(:post).once.and_return(token_response('service-token'))
+
+          2.times { expect(platform.service_access_token(client_id: client_id, scopes: [score_scope])).to eq('service-token') }
+        end
+
+        it 'requests a separate token for a different scope set' do
+          expect(HTTParty).to receive(:post).twice.and_return(token_response('score-token'), token_response('lineitem-token'))
+
+          expect(platform.service_access_token(client_id: client_id, scopes: [score_scope])).to eq('score-token')
+          expect(platform.service_access_token(client_id: client_id, scopes: [LtiConstants::AgsScopes::LINEITEM])).to eq('lineitem-token')
+        end
+
+        it 'caches the token for its expires_in less a minute' do
+          allow(HTTParty).to receive(:post).and_return(token_response('service-token', expires_in: 600))
+          expect(cache).to receive(:write).with(kind_of(String), 'service-token', expires_in: 540.seconds).and_call_original
+
+          platform.service_access_token(client_id: client_id, scopes: [score_scope])
+        end
+
+        it 'does not cache the key under the token or the assertion' do
+          allow(HTTParty).to receive(:post).and_return(token_response('service-token'))
+          expect(cache).to receive(:write).with(%r{\Apanda_pal/lti_service_tokens/[0-9a-f]{64}\z}, anything, anything)
+
+          platform.service_access_token(client_id: client_id, scopes: [score_scope])
+        end
+
+        it 'fetches a new token when forced' do
+          expect(HTTParty).to receive(:post).twice.and_return(token_response('first'), token_response('second'))
+
+          platform.service_access_token(client_id: client_id, scopes: [score_scope])
+          expect(platform.service_access_token(client_id: client_id, scopes: [score_scope], force: true)).to eq('second')
+        end
+
+        it 'raises ServiceTokenError with the status, without echoing the response body, on a non-2xx answer' do
+          allow(HTTParty).to receive(:post).and_return(http_response(400, '{"error":"invalid_client","assertion":"secret-assertion"}'))
+
+          expect {
+            platform.service_access_token(client_id: client_id, scopes: [score_scope])
+          }.to raise_error(Platform::ServiceTokenError) { |error|
+            expect(error.status).to eq(400)
+            expect(error.message).to eq('token request answered 400')
+            expect(error).to be_a(PandaPal::LtiServiceError)
+          }
+        end
+
+        it 'raises ServiceTokenError when the response has no access_token' do
+          allow(HTTParty).to receive(:post).and_return(http_response(200, '{"token_type":"Bearer"}'))
+
+          expect {
+            platform.service_access_token(client_id: client_id, scopes: [score_scope])
+          }.to raise_error(Platform::ServiceTokenError, /no access_token/)
+        end
+
+        it 'wraps network errors in LtiServiceError' do
+          allow(HTTParty).to receive(:post).and_raise(Net::OpenTimeout)
+
+          expect {
+            platform.service_access_token(client_id: client_id, scopes: [score_scope])
+          }.to raise_error(PandaPal::LtiServiceError, 'token request failed: Net::OpenTimeout')
+        end
+
+        it 'uses the Generic platform grant_url' do
+          generic = Platform::Generic.from_urls('https://lms.example.com', grant: '/oauth/token')
+          expect(HTTParty).to receive(:post).with('https://lms.example.com/oauth/token', anything).and_return(token_response('generic-token'))
+
+          expect(generic.service_access_token(client_id: client_id, scopes: [score_scope])).to eq('generic-token')
+        end
+      end
+
+      describe '#expire_service_access_token' do
+        it 'drops the cached token so the next call requests a new one' do
+          expect(HTTParty).to receive(:post).twice.and_return(token_response('first'), token_response('second'))
+
+          platform.service_access_token(client_id: client_id, scopes: [score_scope])
+          platform.expire_service_access_token(client_id: client_id, scopes: [score_scope])
+
+          expect(platform.service_access_token(client_id: client_id, scopes: [score_scope])).to eq('second')
+        end
+      end
+
+      describe '#service_request' do
+        let(:url) { 'https://canvas.example.com/api/lti/courses/1/line_items/2/scores' }
+
+        it 'sends the bearer token with the given headers and body' do
+          allow(HTTParty).to receive(:post).with(grant_url, anything).and_return(token_response('service-token'))
+          expect(HTTParty).to receive(:post).with(url, hash_including(
+            headers: { 'Content-Type' => 'application/json', 'Authorization' => 'Bearer service-token' },
+            body: '{}',
+            open_timeout: 5,
+          )).and_return(http_response(200))
+
+          response = platform.service_request(:post, url, client_id: client_id, scopes: [score_scope],
+            headers: { 'Content-Type' => 'application/json' }, body: '{}')
+
+          expect(response.code).to eq(200)
+        end
+
+        it 'retries once with a new token when a cached token is refused with a 401' do
+          cache.write(platform.send(:service_token_cache_key, client_id, [score_scope]), 'stale-token')
+          expect(HTTParty).to receive(:post).with(grant_url, anything).once.and_return(token_response('fresh-token'))
+          expect(HTTParty).to receive(:post).with(url, hash_including(headers: { 'Authorization' => 'Bearer stale-token' })).and_return(http_response(401))
+          expect(HTTParty).to receive(:post).with(url, hash_including(headers: { 'Authorization' => 'Bearer fresh-token' })).and_return(http_response(200))
+
+          response = platform.service_request(:post, url, client_id: client_id, scopes: [score_scope])
+
+          expect(response.code).to eq(200)
+          expect(cache.read(platform.send(:service_token_cache_key, client_id, [score_scope]))).to eq('fresh-token')
+        end
+
+        it 'does not retry when a freshly issued token is refused' do
+          expect(HTTParty).to receive(:post).with(grant_url, anything).once.and_return(token_response('fresh-token'))
+          expect(HTTParty).to receive(:post).with(url, anything).once.and_return(http_response(401))
+
+          expect(platform.service_request(:post, url, client_id: client_id, scopes: [score_scope]).code).to eq(401)
+        end
+
+        it 'returns the second 401 when the refreshed token is refused too' do
+          cache.write(platform.send(:service_token_cache_key, client_id, [score_scope]), 'stale-token')
+          allow(HTTParty).to receive(:post).with(grant_url, anything).and_return(token_response('fresh-token'))
+          expect(HTTParty).to receive(:post).with(url, anything).twice.and_return(http_response(401))
+
+          expect(platform.service_request(:post, url, client_id: client_id, scopes: [score_scope]).code).to eq(401)
+        end
+      end
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.17.1
+  version: 5.18.0
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -133,6 +133,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- AGS.md
 - MIT-LICENSE
 - README.md
 - Rakefile
@@ -151,6 +152,8 @@ files:
 - app/lib/lti_xml/base_platform.rb
 - app/lib/lti_xml/bridge_platform.rb
 - app/lib/lti_xml/canvas_platform.rb
+- app/lib/panda_pal/ags_client.rb
+- app/lib/panda_pal/ags_helpers.rb
 - app/lib/panda_pal/deep_linking_helpers.rb
 - app/lib/panda_pal/launch_url_helpers.rb
 - app/lib/panda_pal/lti_jwt_validator.rb
@@ -209,6 +212,7 @@ files:
 - spec/internal/config/storage.yml
 - spec/internal/db/schema.rb
 - spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
+- spec/lib/panda_pal/ags_client_spec.rb
 - spec/lib/panda_pal/helpers/secure_headers_spec.rb
 - spec/lib/panda_pal/helpers/session_replacement_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
@@ -254,6 +258,7 @@ test_files:
 - spec/internal/config/storage.yml
 - spec/internal/db/schema.rb
 - spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
+- spec/lib/panda_pal/ags_client_spec.rb
 - spec/lib/panda_pal/helpers/secure_headers_spec.rb
 - spec/lib/panda_pal/helpers/session_replacement_spec.rb
 - spec/models/panda_pal/api_call_spec.rb