panda_pal 5.18.2 → 5.19.0.beta2

data/app/models/panda_pal/session.rb

@@ -211,6 +211,20 @@ module PandaPal
       launch_params['https://www.instructure.com/placement'] || launch_params[:launch_type]
     end
 
+    # The PandaPal tool (see PandaPal.define_tool) this session was launched through.
+    def lti_tool
+      (tool.presence || PandaPal::DEFAULT_TOOL).to_sym
+    end
+
+    # The main_app route a +launch_type+ launch lands on, per this session's tool.
+    def lti_launch_route(launch_type)
+      LaunchUrlHelpers.launch_route(launch_type, tool: lti_tool)
+    end
+
+    def deep_link_redirect_url(request)
+      LaunchUrlHelpers.deep_link_redirect_url(request, tool: lti_tool)
+    end
+
     def custom_lti_params
       @custom_lti_params ||= begin
         # LT 1.3
@@ -230,7 +244,11 @@ module PandaPal
 
     def get_lti_cust_param(key, default: :if_not_var)
       nkey = key.to_s.gsub(/^custom_/, '')
-      default_value = ->() { PandaPal.lti_custom_params[nkey] || PandaPal.lti_custom_params["custom_#{nkey}"] }
+      default_value = ->() do
+        tool = PandaPal.lti_tool?(lti_tool) ? lti_tool : PandaPal::DEFAULT_TOOL
+        params = PandaPal.lti_custom_params(tool)
+        params[nkey] || params["custom_#{nkey}"]
+      end
 
       val = launch_params.dig("https://purl.imsglobal.org/spec/lti/claim/custom", nkey) || launch_params[nkey] || launch_params["custom_#{nkey}"]
 

data/config/initializers/apartment.rb

@@ -253,7 +253,7 @@ end
 
 Apartment.configure do |config|
   config.excluded_models ||= []
-  config.excluded_models |= ['PandaPal::Organization']
+  config.excluded_models |= ['PandaPal::Organization', 'PandaPal::LtiRegistration']
 
   config.with_multi_server_setup = true unless Rails.env.test?
 

data/db/migrate/20261006000000_create_panda_pal_lti_registrations.rb

@@ -0,0 +1,14 @@
+class CreatePandaPalLtiRegistrations < ActiveRecord::Migration[6.1]
+  def change
+    create_table :panda_pal_lti_registrations do |t|
+      t.references :panda_pal_organization, null: false, index: true
+      t.string :tool, null: false
+      t.string :client_id, null: false
+      t.string :deployment_id
+
+      t.timestamps null: false
+    end
+
+    add_index :panda_pal_lti_registrations, [:client_id, :deployment_id], unique: true, name: 'index_panda_pal_lti_registrations_on_client_and_deployment'
+  end
+end

data/db/migrate/20261006000001_add_tool_to_panda_pal_sessions.rb

@@ -0,0 +1,5 @@
+class AddToolToPandaPalSessions < ActiveRecord::Migration[6.1]
+  def change
+    add_column :panda_pal_sessions, :tool, :string
+  end
+end

data/lib/panda_pal/helpers/controller_helper.rb

@@ -63,9 +63,17 @@ module PandaPal::Helpers
         return false
       end
 
+      # LTI 1.0 tools share the Organization's consumer key, so the tool comes
+      # from its (OAuth-signed) custom field instead of the key.
+      lti_tool = params[:"custom_#{PandaPal::TOOL_CUSTOM_FIELD}"]
+      unless PandaPal.lti_tool?(lti_tool)
+        render plain: 'Unrecognized LTI tool', status: :unauthorized
+        return false
+      end
+
       @organization.switch_tenant
 
-      start_panda_session!
+      start_panda_session!(tool: PandaPal.normalize_lti_tool!(lti_tool).to_s)
     end
 
     def validate_v1p3_launch
@@ -78,6 +86,15 @@ module PandaPal::Helpers
 
       client_id = decoded_jwt['aud']
       deployment_id = decoded_jwt['https://purl.imsglobal.org/spec/lti/claim/deployment_id']
+      lti_tool = PandaPal::DEFAULT_TOOL
+
+      # Each tool is its own Developer Key, so the client_id (signed, as `aud`)
+      # identifies both the Organization and the tool.
+      registration = PandaPal::LtiRegistration.for_launch(decoded_jwt['azp'].presence || Array(client_id).first, deployment_id)
+      if registration
+        @organization = registration.panda_pal_organization
+        lti_tool = registration.lti_tool
+      end
 
       if deployment_id.present?
         @organization ||= PandaPal::Organization.find_by(key: "#{client_id}/#{deployment_id}")
@@ -89,6 +106,7 @@ module PandaPal::Helpers
       params[:session_key] = params[:state]
 
       raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present?
+      raise JSON::JWT::VerificationFailed, 'Unrecognized LTI tool' unless PandaPal.lti_tool?(lti_tool)
       raise JSON::JWT::VerificationFailed, 'Organization does not trust platform' unless @organization.trusted_platform?(current_lti_platform)
 
       begin
@@ -111,6 +129,7 @@ module PandaPal::Helpers
 
       @current_session = login_session.dup
       @current_session.panda_pal_organization = @organization
+      @current_session.tool = lti_tool.to_s
       @current_session.save!
 
       @decoded_lti_jwt = decoded_jwt

data/lib/panda_pal/helpers/route_helper.rb

@@ -6,10 +6,17 @@ module PandaPal::Helpers::RouteHelper
     nav, to = options.first
     options[:to] = to
     options.delete nav
-    path = "#{base_path}/#{nav.to_s}"
 
     lti_options = options.delete(:lti_options) || {}
 
+    # Non-default tools get their own path segment, so the same placement can be
+    # declared once per tool without the routes colliding.
+    tool = options.delete(:tool) || lti_options[:tool]
+    tool = tool.presence&.to_sym || PandaPal::DEFAULT_TOOL
+    lti_options[:tool] = tool
+
+    path = tool == PandaPal::DEFAULT_TOOL ? "#{base_path}/#{nav.to_s}" : "#{base_path}/#{tool}/#{nav.to_s}"
+
     lti_options[:auto_launch] = options.delete(:auto_launch)
     # NB if lti_nav is outside an :organization_id scope, auto_launch defaults differently between 1.1 and 1.3 - 1.1 defaults off, 1.3 defaults on
     lti_options[:auto_launch] = true if lti_options[:auto_launch].nil? && (@scope[:path] || '').include?(':organization_id')

data/lib/panda_pal/helpers/session_replacement.rb

@@ -31,9 +31,9 @@ module PandaPal::Helpers
       current_session.try(:save)
     end
 
-    def start_panda_session!
+    def start_panda_session!(**attributes)
       raise "Session already started" if @current_session.present?
-      @current_session = PandaPal::Session.new(panda_pal_organization_id: current_organization&.id).tap do |session|
+      @current_session = PandaPal::Session.new(panda_pal_organization_id: current_organization&.id, **attributes).tap do |session|
         session.save!
       end
     end

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.18.2'
+  VERSION = '5.19.0.beta2'
 end

data/lib/panda_pal.rb

@@ -22,7 +22,20 @@ module PandaPal
     end
   end
 
-  @@lti_navigation = {}
+  # A single host app can publish more than one LTI tool (each its own Canvas
+  # Developer Key / tool config, with its own placements). Everything that
+  # isn't given an explicit tool belongs to DEFAULT_TOOL, so single-tool apps
+  # never need to know tools exist.
+  DEFAULT_TOOL = :default
+
+  # Custom field added to every non-default tool's config, so a launch (and an
+  # installed tool in Canvas) can be traced back to the tool it came from.
+  TOOL_CUSTOM_FIELD = 'panda_pal_tool'.freeze
+
+  class UnknownLtiTool < StandardError; end
+
+  @@lti_navigation = { DEFAULT_TOOL => {} }
+  @@lti_tools = {}
   @@lti_options = {}
   @@lti_properties = {}
   @@lti_environments = {}
@@ -59,8 +72,58 @@ module PandaPal
     @@lti_custom_params = custom_params.with_indifferent_access
   end
 
-  def self.lti_custom_params
-    @@lti_custom_params.deep_dup
+  def self.lti_custom_params(tool = DEFAULT_TOOL)
+    tool = normalize_lti_tool!(tool)
+    params = @@lti_custom_params.deep_dup
+    return params if tool == DEFAULT_TOOL
+
+    params.merge!(@@lti_tools[tool][:custom_params] || {})
+    params[TOOL_CUSTOM_FIELD] = tool.to_s
+    params
+  end
+
+  # Registers an additional LTI tool. `options` are merged over lti_options
+  # when building that tool's config (title, description, deep_link_redirect_url,
+  # ...), and `custom_params:` are merged over lti_custom_params.
+  #
+  #   PandaPal.define_tool(:translate, title: 'My LTI - Translate', custom_params: { ... })
+  #   PandaPal.stage_placement(:editor_button, tool: :translate, ...)
+  def self.define_tool(name, options = {})
+    name = name.to_sym
+    raise ArgumentError, "#{DEFAULT_TOOL} is configured through lti_options, not define_tool" if name == DEFAULT_TOOL
+
+    options = options.with_indifferent_access
+    tool = (@@lti_tools[name] ||= {})
+    tool[:custom_params] = (tool[:custom_params] || {}).merge(options.delete(:custom_params) || {}).with_indifferent_access
+    tool[:options] = (tool[:options] || {}).merge(options)
+    @@lti_navigation[name] ||= {}
+    name
+  end
+
+  def self.lti_tools
+    [DEFAULT_TOOL, *@@lti_tools.keys]
+  end
+
+  def self.lti_tool?(name)
+    return true if name.blank?
+    lti_tools.include?(name.to_sym)
+  end
+
+  # Blank means the default tool. Anything else must have been defined.
+  def self.normalize_lti_tool!(name)
+    return DEFAULT_TOOL if name.blank?
+    name = name.to_sym
+    raise UnknownLtiTool, "Unknown LTI tool '#{name}'" unless lti_tool?(name)
+    name
+  end
+
+  # lti_options as seen by one tool - its own options merged over the shared ones.
+  def self.lti_tool_options(tool = DEFAULT_TOOL)
+    tool = normalize_lti_tool!(tool)
+    opts = lti_options
+    return opts if tool == DEFAULT_TOOL
+
+    opts.with_indifferent_access.merge(@@lti_tools[tool][:options].deep_dup)
   end
 
   def self.lti_scopes=(scopes)
@@ -77,7 +140,12 @@ module PandaPal
   end
 
   def self.stage_placement(placement, options = {})
-    @@lti_navigation[placement] ||= {}
+    options = options.dup
+    tool = options.delete(:tool).presence&.to_sym || DEFAULT_TOOL
+    define_tool(tool) unless tool == DEFAULT_TOOL || @@lti_tools.key?(tool)
+
+    placements = (@@lti_navigation[tool] ||= {})
+    placements[placement] ||= {}
 
     if options.delete(:deep_linking)
       options = options.merge({
@@ -86,11 +154,12 @@ module PandaPal
       })
     end
 
-    @@lti_navigation[placement].merge!(options)
+    placements[placement].merge!(options)
   end
 
-  def self.lti_paths
-    @@lti_navigation.deep_dup
+  def self.lti_paths(tool = DEFAULT_TOOL)
+    tool = normalize_lti_tool!(tool)
+    (@@lti_navigation[tool] || {}).deep_dup
   end
 
   def self.lti_private_key
@@ -157,9 +226,12 @@ module PandaPal
   end
 
   def self.validate_lti_navigation(errors = [])
-    @@lti_navigation.each do |k, v|
-      next if v[:route_helper_key]
-      errors << "lti navigation '#{k}' does not have a Route!" unless (LaunchUrlHelpers.launch_url(k) rescue nil)
+    @@lti_navigation.each do |tool, placements|
+      placements.each do |k, v|
+        next if v[:route_helper_key]
+        label = tool == DEFAULT_TOOL ? "'#{k}'" : "'#{k}' (tool '#{tool}')"
+        errors << "lti navigation #{label} does not have a Route!" unless (LaunchUrlHelpers.launch_url(k, tool: tool) rescue nil)
+      end
     end
     errors
   end

data/panda_pal.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |s|
   s.license     = "MIT"
 
   s.files = Dir["{app,config,db,lib}/**/*", "MIT-LICENSE", "Rakefile", "README.md", "AGS.md", "panda_pal.gemspec"]
-  s.test_files = Dir["spec/**/*"].reject{|f| f =~ /\/log\//}
+  # s.test_files = Dir["spec/**/*"].reject{|f| f =~ /\/log\//}
 
   s.add_dependency "rails", ">= 4.2"
   s.add_dependency 'ros-apartment', '~> 3.0'
@@ -27,5 +27,6 @@ Gem::Specification.new do |s|
   s.add_dependency 'attr_encrypted', '~> 4.2'
   s.add_dependency 'secure_headers', '>= 6.1', '< 8'
   s.add_dependency 'jwt'
+  s.add_dependency 'json-jwt', '>= 1.15' # LTI 1.3 id_token decoding/verification (validate_v1p3_launch)
   s.add_dependency 'httparty'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.18.2
+  version: 5.19.0.beta2
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -113,6 +113,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: json-jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.15'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.15'
 - !ruby/object:Gem::Dependency
   name: httparty
   requirement: !ruby/object:Gem::Requirement
@@ -158,6 +172,7 @@ files:
 - app/lib/panda_pal/launch_url_helpers.rb
 - app/lib/panda_pal/lti_jwt_validator.rb
 - app/models/panda_pal/api_call.rb
+- app/models/panda_pal/lti_registration.rb
 - app/models/panda_pal/organization.rb
 - app/models/panda_pal/organization_concerns/multi_database_sharding.rb
 - app/models/panda_pal/organization_concerns/organization_builder.rb
@@ -183,6 +198,8 @@ files:
 - db/migrate/20171205194657_remove_old_organization_settings.rb
 - db/migrate/20220721095653_create_panda_pal_api_calls.rb
 - db/migrate/20250401214421_rename_session_session_key.rb
+- db/migrate/20261006000000_create_panda_pal_lti_registrations.rb
+- db/migrate/20261006000001_add_tool_to_panda_pal_sessions.rb
 - lib/panda_pal.rb
 - lib/panda_pal/concerns/ability_helper.rb
 - lib/panda_pal/engine.rb
@@ -199,30 +216,6 @@ files:
 - lib/panda_pal/version.rb
 - lib/tasks/panda_pal_tasks.rake
 - panda_pal.gemspec
-- spec/controllers/panda_pal/api_call_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
-- spec/core/apartment_multidb_spec.rb
-- spec/factories/panda_pal_organizations.rb
-- spec/factories/panda_pal_sessions.rb
-- spec/internal/app/models/account.rb
-- spec/internal/app/models/admin.rb
-- spec/internal/config/database.yml
-- spec/internal/config/routes.rb
-- spec/internal/config/storage.yml
-- spec/internal/db/schema.rb
-- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
-- spec/lib/panda_pal/ags_client_spec.rb
-- spec/lib/panda_pal/helpers/secure_headers_spec.rb
-- spec/lib/panda_pal/helpers/session_replacement_spec.rb
-- spec/models/panda_pal/api_call_spec.rb
-- spec/models/panda_pal/organization/settings_validation_spec.rb
-- spec/models/panda_pal/organization/task_scheduling_spec.rb
-- spec/models/panda_pal/organization_spec.rb
-- spec/models/panda_pal/platform_spec.rb
-- spec/models/panda_pal/session_account_roles_spec.rb
-- spec/models/panda_pal/session_spec.rb
-- spec/spec_helper.rb
 homepage: http://instructure.com
 licenses:
 - MIT
@@ -244,28 +237,4 @@ requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
 summary: LTI mountable engine
-test_files:
-- spec/controllers/panda_pal/api_call_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
-- spec/core/apartment_multidb_spec.rb
-- spec/factories/panda_pal_organizations.rb
-- spec/factories/panda_pal_sessions.rb
-- spec/internal/app/models/account.rb
-- spec/internal/app/models/admin.rb
-- spec/internal/config/database.yml
-- spec/internal/config/routes.rb
-- spec/internal/config/storage.yml
-- spec/internal/db/schema.rb
-- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
-- spec/lib/panda_pal/ags_client_spec.rb
-- spec/lib/panda_pal/helpers/secure_headers_spec.rb
-- spec/lib/panda_pal/helpers/session_replacement_spec.rb
-- spec/models/panda_pal/api_call_spec.rb
-- spec/models/panda_pal/organization/settings_validation_spec.rb
-- spec/models/panda_pal/organization/task_scheduling_spec.rb
-- spec/models/panda_pal/organization_spec.rb
-- spec/models/panda_pal/platform_spec.rb
-- spec/models/panda_pal/session_account_roles_spec.rb
-- spec/models/panda_pal/session_spec.rb
-- spec/spec_helper.rb
+test_files: []

data/spec/controllers/panda_pal/api_call_controller_spec.rb

@@ -1,25 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe PandaPal::ApiCallController, type: :controller do
-  let!(:api_call) { PandaPal::ApiCall.create!(logic: '"#{p[:foo]}_bar"') }
-
-  def json_body
-    JSON.parse(response.body)
-  end
-
-  describe "#call" do
-    it "calls the function with parameters" do
-      get :call, params: { token: api_call.jwt_token, foo: 'bar', use_route: 'panda_pal' }
-      expect(response).to be_successful
-      expect(json_body["status"]).to eq 'ok'
-      expect(json_body["result"]).to eq 'bar_bar'
-    end
-
-    it "fails given a bad JWT" do
-      get :call, params: { token: "bad.jwt.token", foo: 'bar', use_route: 'panda_pal' }
-      expect(response).not_to be_successful
-      expect(json_body["status"]).to eq 'error'
-      expect(json_body["error"]).to eq 'Invalid JWT'
-    end
-  end
-end

data/spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb

@@ -1,110 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe "PandaPal::LtiV1P0Controller", type: :request do
-  let(:organization) { create(:panda_pal_organization) }
-  let(:launch_url) { panda_pal.v1p0_launch_url(host: 'www.example.com') }
-
-  # Signs a full LTI v1p0 launch params hash the same way an LMS (Tool Consumer)
-  # would, using the platform-side half of the very same `ims-lti` gem that
-  # PandaPal uses on the tool-provider side to validate incoming launches.
-  def signed_launch_params(secret:, timestamp: Time.now.to_i, launch_type: 'panda_pal')
-    consumer = IMS::LTI::ToolConsumer.new(organization.key, secret, {
-      'resource_link_id' => 'test-resource-link-id',
-    })
-    consumer.launch_url = launch_url
-    consumer.timestamp = timestamp
-    # `launch_type` isn't a spec'd LTI param, but the controller reads it from
-    # params, so it must be included in the signed payload or the signature
-    # PandaPal recomputes on the real request body won't match.
-    consumer.set_non_spec_param('launch_type', launch_type)
-    consumer.generate_launch_data
-  end
-
-  after do
-    # `validate_v1p0_launch` permanently switches the Apartment tenant to the
-    # organization's schema on a successful launch (PandaPal::Organization
-    # #switch_tenant with no block => Apartment::Tenant.switch!). Reset it so
-    # this doesn't leak into other spec files run later in the suite.
-    Apartment::Tenant.reset
-  end
-
-  describe 'POST /v1p0/launch' do
-    context 'with a validly-signed launch' do
-      it 'passes signature validation, starts a session, and redirects instead of rendering the 401 body' do
-        params = signed_launch_params(secret: organization.secret)
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).not_to have_http_status(:unauthorized)
-        expect(response.body).not_to include('Failed to validate LTI v1p0 launch')
-        expect(response).to have_http_status(:found)
-        expect(response.headers['Location']).to include('/panda_pal')
-
-        # The session record is created after PandaPal switches Apartment tenants
-        # to the organization's own schema, so look it up there.
-        session_count = organization.switch_tenant { PandaPal::Session.count }
-        expect(session_count).to eq(1)
-      end
-    end
-
-    context 'with an invalid signature (wrong secret used to sign)' do
-      it 'renders 401 with the failure body' do
-        params = signed_launch_params(secret: 'not-the-real-secret')
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-
-    context 'with a tampered parameter after signing' do
-      it 'renders 401 with the failure body' do
-        params = signed_launch_params(secret: organization.secret)
-        params['resource_link_id'] = 'a-different-resource-link-id'
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-
-    context 'with a stale oauth_timestamp' do
-      it 'renders 401 without ever consulting IMS::LTI::ToolProvider' do
-        stale_timestamp = 400.seconds.ago.to_i
-        params = signed_launch_params(secret: organization.secret, timestamp: stale_timestamp)
-
-        expect(IMS::LTI::ToolProvider).not_to receive(:new)
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-  end
-
-  describe 'safari_override (browser gem regression coverage)' do
-    let(:safari_user_agent) do
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
-    end
-    let(:chrome_user_agent) do
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
-    end
-
-    # safari_override is the very first thing validate_launch! does, before any
-    # OAuth/org checks, so an otherwise-invalid launch is sufficient to exercise it.
-    it 'applies the secure_headers safari override when the User-Agent is Safari' do
-      expect_any_instance_of(PandaPal::LtiV1P0Controller).to receive(:use_secure_headers_override).with(:safari_override)
-
-      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => safari_user_agent }
-    end
-
-    it 'does not apply the override for a non-Safari User-Agent (Chrome)' do
-      expect_any_instance_of(PandaPal::LtiV1P0Controller).not_to receive(:use_secure_headers_override)
-
-      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => chrome_user_agent }
-    end
-  end
-end

data/spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb

@@ -1,108 +0,0 @@
-require 'spec_helper'
-require 'nokogiri'
-
-RSpec.describe "PandaPal::LtiV1P3Controller", type: :request do
-  describe 'GET /v1p3/public_jwks' do
-    let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
-    let(:test_jwk) { JWT::JWK.new(rsa_key, { use: 'sig', alg: 'RS256' }) }
-
-    before { PandaPal.jwk = test_jwk }
-
-    after do
-      # PandaPal.jwk memoizes into a class variable (`@@jwk ||= ...`). Reset it
-      # so our test key doesn't leak into other spec files run later in the suite.
-      PandaPal.jwk = nil
-    end
-
-    it 'renders a 200 JSON JWK Set whose key matches PandaPal.jwk, with no private key material' do
-      get "/panda_pal/v1p3/public_jwks"
-
-      expect(response).to have_http_status(:ok)
-
-      expected_body = JSON.parse(JWT::JWK::Set.new(test_jwk).export.to_json)
-      body = JSON.parse(response.body)
-
-      expect(body).to eq(expected_body)
-      expect(body['keys']).to be_an(Array)
-      expect(body['keys'].length).to eq(1)
-
-      returned_key = body['keys'].first
-      expect(returned_key['kty']).to eq('RSA')
-      expect(returned_key['use']).to eq('sig')
-      expect(returned_key['alg']).to eq('RS256')
-      expect(returned_key['n']).to eq(test_jwk[:n])
-      expect(returned_key['e']).to eq(test_jwk[:e])
-      # Only the public modulus/exponent should ever be exposed - never private key material.
-      expect(returned_key.keys).not_to include('d', 'p', 'q', 'dp', 'dq', 'qi')
-    end
-  end
-
-  describe 'GET /v1p3/oidc_login' do
-    let(:login_params) do
-      {
-        client_id: 'test-client-id',
-        login_hint: 'test-login-hint',
-        lti_message_hint: 'test-lti-message-hint',
-        iss: 'https://canvas.instructure.com',
-      }
-    end
-
-    it 'renders the auto-submit form targeting the platform auth redirect URL, with the expected hidden fields' do
-      get "/panda_pal/v1p3/oidc_login", params: login_params
-
-      expect(response).to have_http_status(:ok)
-
-      doc = Nokogiri::HTML(response.body)
-      form = doc.at_css('form#redirect-form')
-      expect(form).not_to be_nil
-
-      created_session = PandaPal::Session.order(:id).last
-      expect(created_session).not_to be_nil
-
-      expect(form['action']).to eq(PandaPal::Platform::Canvas.new(iss: 'https://canvas.instructure.com').authentication_redirect_url)
-
-      hidden_fields = form.css('input[type=hidden]').each_with_object({}) do |input, h|
-        h[input['name']] = input['value']
-      end
-
-      expect(hidden_fields['client_id']).to eq('test-client-id')
-      expect(hidden_fields['login_hint']).to eq('test-login-hint')
-      expect(hidden_fields['lti_message_hint']).to eq('test-lti-message-hint')
-      expect(hidden_fields['scope']).to eq('openid')
-      expect(hidden_fields['response_type']).to eq('id_token')
-      expect(hidden_fields['state']).to eq(created_session.session_key)
-      expect(hidden_fields['nonce']).to eq(created_session[:lti_oauth_nonce])
-      expect(hidden_fields['nonce']).not_to be_blank
-    end
-  end
-
-  describe 'GET /v1p3/config' do
-    before { PandaPal.lti_environments = { domain: 'tool.example.com' } }
-
-    after do
-      PandaPal.lti_environments = {}
-      PandaPal.lti_scopes = []
-    end
-
-    it 'publishes no scopes by default' do
-      get "/panda_pal/v1p3/config"
-
-      expect(response).to have_http_status(:ok)
-      expect(JSON.parse(response.body)['scopes']).to eq([])
-    end
-
-    it 'publishes the configured PandaPal.lti_scopes' do
-      PandaPal.lti_scopes = [
-        PandaPal::LtiConstants::AgsScopes::SCORE,
-        PandaPal::LtiConstants::AgsScopes::LINEITEM_READONLY,
-      ]
-
-      get "/panda_pal/v1p3/config"
-
-      expect(JSON.parse(response.body)['scopes']).to eq([
-        'https://purl.imsglobal.org/spec/lti-ags/scope/score',
-        'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem.readonly',
-      ])
-    end
-  end
-end