panda_pal 5.18.2 → 5.19.0.beta2

data/spec/lib/panda_pal/ags_client_spec.rb

@@ -1,385 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe PandaPal::AgsClient do
-  let(:platform) { PandaPal::Platform::Canvas.new(iss: 'https://canvas.instructure.com') }
-  let(:client_id) { '10000000000042' }
-  let(:lineitem) { 'https://canvas.example.com/api/lti/courses/1/line_items/7' }
-  let(:lineitems) { 'https://canvas.example.com/api/lti/courses/1/line_items' }
-  let(:scopes) { PandaPal::LtiConstants::AgsScopes::ALL }
-  let(:user_id) { 'launch-sub-uuid' }
-
-  subject(:client) do
-    described_class.new(platform: platform, client_id: client_id, scopes: scopes,
-      lineitem: lineitem, lineitems: lineitems, user_id: user_id)
-  end
-
-  def http_response(code, body = '', headers = {})
-    double('HTTParty::Response', code: code, success?: (200..299).cover?(code), body: body, headers: headers)
-  end
-
-  def expect_service_request(method, url, scope, response, **options)
-    expect(platform).to receive(:service_request)
-      .with(method, url, client_id: client_id, scopes: [scope], **options)
-      .and_return(response)
-  end
-
-  describe '.from_launch' do
-    let(:launch) do
-      {
-        'sub' => user_id,
-        'aud' => client_id,
-        PandaPal::LtiConstants::Ags::ENDPOINT => {
-          'scope' => [PandaPal::LtiConstants::AgsScopes::SCORE],
-          'lineitem' => lineitem,
-          'lineitems' => lineitems,
-        },
-      }
-    end
-
-    it 'reads the AGS endpoint claim, the sub and the client_id' do
-      built = described_class.from_launch(launch, platform: platform)
-
-      expect(built.platform).to eq(platform)
-      expect(built.client_id).to eq(client_id)
-      expect(built.user_id).to eq(user_id)
-      expect(built.lineitem).to eq(lineitem)
-      expect(built.lineitems).to eq(lineitems)
-      expect(built.scopes).to eq([PandaPal::LtiConstants::AgsScopes::SCORE])
-    end
-
-    it 'prefers azp over an aud array' do
-      built = described_class.from_launch(launch.merge('aud' => ['other', client_id], 'azp' => client_id), platform: platform)
-
-      expect(built.client_id).to eq(client_id)
-    end
-
-    it 'grants nothing when the launch has no AGS claim' do
-      built = described_class.from_launch(launch.except(PandaPal::LtiConstants::Ags::ENDPOINT), platform: platform)
-
-      expect(built.scopes).to eq([])
-      expect(built.lineitem).to be_nil
-      expect { built.post_score(score_given: 1, score_maximum: 1) }.to raise_error(described_class::NotGranted)
-    end
-  end
-
-  describe '.for_session and Session#ags_client' do
-    let(:organization) { create(:panda_pal_organization, key: "#{client_id}/deployment-1") }
-    let(:session) do
-      PandaPal::Session.new(panda_pal_organization: organization, data: {
-        lti_platform: platform.serialize,
-        launch_params: {
-          'sub' => user_id,
-          'aud' => client_id,
-          PandaPal::LtiConstants::Ags::ENDPOINT => { 'scope' => scopes, 'lineitem' => lineitem, 'lineitems' => lineitems },
-        },
-      })
-    end
-
-    it 'builds a client from the session launch_params and lti_platform' do
-      built = session.ags_client
-
-      expect(built).to be_a(described_class)
-      expect(built.platform).to be_a(PandaPal::Platform::Canvas)
-      expect(built.platform.grant_url).to eq(platform.grant_url)
-      expect(built.client_id).to eq(client_id)
-      expect(built.lineitem).to eq(lineitem)
-      expect(built.user_id).to eq(user_id)
-      expect(built.scopes).to eq(scopes)
-      expect(session.ags_client).to be(built)
-    end
-
-    it 'falls back to the client_id half of the organization key when the launch has no aud' do
-      session.data[:launch_params].delete('aud')
-
-      expect(described_class.for_session(session).client_id).to eq(client_id)
-    end
-
-    it 'is exposed to controllers through PandaPal::AgsHelpers' do
-      host = Class.new do
-        include PandaPal::AgsHelpers
-
-        attr_reader :current_session
-
-        def initialize(session)
-          @current_session = session
-        end
-      end
-
-      expect(host.new(session).ags_client).to be(session.ags_client)
-    end
-  end
-
-  describe '#post_score' do
-    let(:scores_url) { "#{lineitem}/scores" }
-
-    it 'posts the AGS score media type to the lineitem scores endpoint for the launch sub' do
-      captured = nil
-      expect(platform).to receive(:service_request) do |method, url, **options|
-        captured = { method: method, url: url, options: options }
-        http_response(200, '{"resultUrl":"https://canvas.example.com/results/1"}')
-      end
-
-      timestamp = Time.utc(2026, 9, 30, 12, 0, 0, 123_456)
-      result = client.post_score(score_given: 8, score_maximum: 10, timestamp: timestamp)
-
-      expect(result).to eq('resultUrl' => 'https://canvas.example.com/results/1')
-      expect(captured[:method]).to eq(:post)
-      expect(captured[:url]).to eq(scores_url)
-      expect(captured[:options][:client_id]).to eq(client_id)
-      expect(captured[:options][:scopes]).to eq([PandaPal::LtiConstants::AgsScopes::SCORE])
-      expect(captured[:options][:headers]).to eq('Content-Type' => 'application/vnd.ims.lis.v1.score+json')
-      expect(JSON.parse(captured[:options][:body])).to eq(
-        'userId' => user_id,
-        'scoreGiven' => 8,
-        'scoreMaximum' => 10,
-        'activityProgress' => 'Completed',
-        'gradingProgress' => 'FullyGraded',
-        'timestamp' => '2026-09-30T12:00:00.123Z',
-      )
-    end
-
-    it 'includes a comment, overrides and extra fields when given' do
-      other_user = SecureRandom.uuid
-      body = nil
-      allow(platform).to receive(:service_request) { |*, **options| body = JSON.parse(options[:body]); http_response(204) }
-
-      result = client.post_score(score_given: 1, score_maximum: 1, comment: 'Well done', user_id: other_user,
-        activity_progress: 'Submitted', grading_progress: 'Pending',
-        'https://canvas.instructure.com/lti/submission': { new_submission: true })
-
-      expect(result).to be_nil
-      expect(body).to include(
-        'userId' => other_user,
-        'comment' => 'Well done',
-        'activityProgress' => 'Submitted',
-        'gradingProgress' => 'Pending',
-        'https://canvas.instructure.com/lti/submission' => { 'new_submission' => true },
-      )
-    end
-
-    it 'omits scoreGiven and scoreMaximum when no score is given' do
-      body = nil
-      allow(platform).to receive(:service_request) { |*, **options| body = JSON.parse(options[:body]); http_response(200, '{}') }
-
-      client.post_score(activity_progress: 'Started', grading_progress: 'NotReady')
-
-      expect(body.keys).not_to include('scoreGiven', 'scoreMaximum')
-    end
-
-    it 'keeps a lineitem query string after the scores segment' do
-      with_query = described_class.new(platform: platform, client_id: client_id, scopes: scopes, user_id: user_id,
-        lineitem: 'https://canvas.example.com/api/lti/courses/1/line_items/7?type_id=abc&x=1')
-      expect(platform).to receive(:service_request)
-        .with(:post, 'https://canvas.example.com/api/lti/courses/1/line_items/7/scores?type_id=abc&x=1', anything)
-        .and_return(http_response(200, '{}'))
-
-      with_query.post_score(score_given: 1, score_maximum: 1)
-    end
-
-    it 'does not double a trailing slash' do
-      expect(platform).to receive(:service_request).with(:post, scores_url, anything).and_return(http_response(200, '{}'))
-
-      described_class.new(platform: platform, client_id: client_id, scopes: scopes, user_id: user_id, lineitem: "#{lineitem}/")
-        .post_score(score_given: 1, score_maximum: 1)
-    end
-
-    it 'refuses before any request when the score scope was not granted' do
-      expect(platform).not_to receive(:service_request)
-
-      limited = described_class.new(platform: platform, client_id: client_id, lineitem: lineitem, user_id: user_id,
-        scopes: [PandaPal::LtiConstants::AgsScopes::LINEITEM_READONLY])
-
-      expect { limited.post_score(score_given: 1, score_maximum: 1) }
-        .to raise_error(described_class::NotGranted, %r{scope/score})
-    end
-
-    it 'refuses before any request when the launch carried no lineitem' do
-      expect(platform).not_to receive(:service_request)
-
-      no_lineitem = described_class.new(platform: platform, client_id: client_id, scopes: scopes, user_id: user_id)
-
-      expect { no_lineitem.post_score(score_given: 1, score_maximum: 1) }
-        .to raise_error(described_class::NotGranted, /no AGS lineitem/)
-    end
-
-    it 'refuses a lineitem that is not an http(s) URL' do
-      expect(platform).not_to receive(:service_request)
-
-      bad = described_class.new(platform: platform, client_id: client_id, scopes: scopes, user_id: user_id, lineitem: 'javascript:alert(1)')
-
-      expect { bad.post_score(score_given: 1, score_maximum: 1) }.to raise_error(described_class::Error, /http\(s\)/)
-    end
-
-    it 'refuses when there is no user id' do
-      expect(platform).not_to receive(:service_request)
-
-      expect { client.post_score(score_given: 1, score_maximum: 1, user_id: nil) }
-        .to raise_error(described_class::NotGranted, /userId/)
-    end
-
-    it 'requires score_maximum alongside score_given' do
-      expect { client.post_score(score_given: 1) }.to raise_error(ArgumentError)
-    end
-
-    it 'refuses when there is no platform' do
-      no_platform = described_class.new(platform: nil, client_id: client_id, scopes: scopes, user_id: user_id, lineitem: lineitem)
-
-      expect { no_platform.post_score(score_given: 1, score_maximum: 1) }.to raise_error(described_class::Error, /platform/)
-    end
-
-    it 'raises RequestFailed with the status on a non-2xx answer' do
-      allow(platform).to receive(:service_request).and_return(http_response(422, '{"errors":"bad"}'))
-
-      expect { client.post_score(score_given: 1, score_maximum: 1) }
-        .to raise_error(described_class::RequestFailed) { |error|
-          expect(error.status).to eq(422)
-          expect(error).to be_a(PandaPal::LtiServiceError)
-        }
-    end
-  end
-
-  describe '#line_items' do
-    let(:container) { PandaPal::LtiConstants::AgsMediaTypes::LINEITEM_CONTAINER }
-    let(:readonly) { PandaPal::LtiConstants::AgsScopes::LINEITEM_READONLY }
-
-    it 'lists line items with the container media type and the read-only scope' do
-      expect_service_request(:get, lineitems, readonly,
-        http_response(200, [{ 'id' => lineitem, 'label' => 'Quiz' }].to_json),
-        headers: { 'Accept' => container })
-
-      expect(client.line_items).to eq([{ 'id' => lineitem, 'label' => 'Quiz' }])
-    end
-
-    it 'adds filters to the query string' do
-      expect_service_request(:get, "#{lineitems}?resource_link_id=rl-1&tag=grade", readonly,
-        http_response(200, '[]'), headers: { 'Accept' => container })
-
-      expect(client.line_items(resource_link_id: 'rl-1', tag: 'grade', resource_id: nil)).to eq([])
-    end
-
-    it 'follows rel="next" links on the same origin' do
-      page_two = "#{lineitems}?page=2"
-      expect_service_request(:get, lineitems, readonly,
-        http_response(200, '[{"id":"a"}]', { 'link' => %(<#{page_two}>; rel="next", <#{lineitems}?page=9>; rel="last") }),
-        headers: { 'Accept' => container })
-      expect_service_request(:get, page_two, readonly, http_response(200, '[{"id":"b"}]'), headers: { 'Accept' => container })
-
-      expect(client.line_items.map { |item| item['id'] }).to eq(%w[a b])
-    end
-
-    it 'does not follow a next link to another origin' do
-      expect_service_request(:get, lineitems, readonly,
-        http_response(200, '[{"id":"a"}]', { 'link' => '<https://attacker.example.com/steal>; rel="next"' }),
-        headers: { 'Accept' => container })
-
-      expect(client.line_items.map { |item| item['id'] }).to eq(%w[a])
-    end
-
-    it 'uses the lineitem scope when only that was granted' do
-      full = described_class.new(platform: platform, client_id: client_id, lineitems: lineitems,
-        scopes: [PandaPal::LtiConstants::AgsScopes::LINEITEM])
-      expect_service_request(:get, lineitems, PandaPal::LtiConstants::AgsScopes::LINEITEM,
-        http_response(200, '[]'), headers: { 'Accept' => container })
-
-      full.line_items
-    end
-
-    it 'refuses when no line item scope was granted' do
-      expect(platform).not_to receive(:service_request)
-
-      score_only = described_class.new(platform: platform, client_id: client_id, lineitems: lineitems,
-        scopes: [PandaPal::LtiConstants::AgsScopes::SCORE])
-
-      expect { score_only.line_items }.to raise_error(described_class::NotGranted, /lineitem/)
-    end
-
-    it 'refuses when the launch carried no lineitems URL' do
-      expect(platform).not_to receive(:service_request)
-
-      no_container = described_class.new(platform: platform, client_id: client_id, scopes: scopes)
-
-      expect { no_container.line_items }.to raise_error(described_class::NotGranted, /lineitems URL/)
-    end
-  end
-
-  describe '#line_item' do
-    it 'gets the launch lineitem with the lineitem media type' do
-      expect_service_request(:get, lineitem, PandaPal::LtiConstants::AgsScopes::LINEITEM_READONLY,
-        http_response(200, { 'id' => lineitem, 'scoreMaximum' => 10 }.to_json),
-        headers: { 'Accept' => PandaPal::LtiConstants::AgsMediaTypes::LINEITEM })
-
-      expect(client.line_item).to eq('id' => lineitem, 'scoreMaximum' => 10)
-    end
-
-    it 'gets an explicit lineitem URL' do
-      other = "#{lineitems}/99"
-      expect_service_request(:get, other, PandaPal::LtiConstants::AgsScopes::LINEITEM_READONLY,
-        http_response(200, '{"id":"99"}'), headers: { 'Accept' => PandaPal::LtiConstants::AgsMediaTypes::LINEITEM })
-
-      expect(client.line_item(other)).to eq('id' => '99')
-    end
-
-    it 'raises RequestFailed when the body is not JSON' do
-      allow(platform).to receive(:service_request).and_return(http_response(200, '<html>'))
-
-      expect { client.line_item }.to raise_error(described_class::RequestFailed, /not JSON/)
-    end
-  end
-
-  describe '#results' do
-    let(:results_url) { "#{lineitem}/results" }
-    let(:container) { PandaPal::LtiConstants::AgsMediaTypes::RESULT_CONTAINER }
-    let(:result_scope) { PandaPal::LtiConstants::AgsScopes::RESULT_READONLY }
-
-    it 'reads the lineitem results with the result container media type' do
-      expect_service_request(:get, results_url, result_scope,
-        http_response(200, [{ 'userId' => user_id, 'resultScore' => 8 }].to_json), headers: { 'Accept' => container })
-
-      expect(client.results).to eq([{ 'userId' => user_id, 'resultScore' => 8 }])
-    end
-
-    it 'filters by user_id and limit, keeping an existing query string' do
-      with_query = described_class.new(platform: platform, client_id: client_id, scopes: scopes,
-        lineitem: "#{lineitem}?type_id=abc")
-      expect_service_request(:get, "#{results_url}?type_id=abc&user_id=#{user_id}&limit=5", result_scope,
-        http_response(200, '[]'), headers: { 'Accept' => container })
-
-      expect(with_query.results(user_id: user_id, limit: 5)).to eq([])
-    end
-
-    it 'refuses when the result scope was not granted' do
-      expect(platform).not_to receive(:service_request)
-
-      score_only = described_class.new(platform: platform, client_id: client_id, lineitem: lineitem,
-        scopes: [PandaPal::LtiConstants::AgsScopes::SCORE])
-
-      expect { score_only.results }.to raise_error(described_class::NotGranted, /result\.readonly/)
-    end
-  end
-
-  describe 'end to end through the platform token' do
-    let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
-
-    before do
-      PandaPal.lti_private_key = rsa_key
-      PandaPal.jwk = nil
-      allow(Rails).to receive(:cache).and_return(ActiveSupport::Cache::MemoryStore.new)
-    end
-
-    after do
-      PandaPal.lti_private_key = nil
-      PandaPal.jwk = nil
-    end
-
-    it 'requests only the score scope and posts with the issued bearer token' do
-      expect(HTTParty).to receive(:post).with(platform.grant_url, hash_including(
-        body: hash_including(grant_type: 'client_credentials', scope: PandaPal::LtiConstants::AgsScopes::SCORE)
-      )).and_return(http_response(200, '{"access_token":"issued","expires_in":3600}'))
-      expect(HTTParty).to receive(:post).with("#{lineitem}/scores", hash_including(
-        headers: { 'Content-Type' => 'application/vnd.ims.lis.v1.score+json', 'Authorization' => 'Bearer issued' }
-      )).and_return(http_response(200, '{}'))
-
-      client.post_score(score_given: 1, score_maximum: 1)
-    end
-  end
-end

data/spec/lib/panda_pal/helpers/secure_headers_spec.rb

@@ -1,77 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe PandaPal::SecureHeaders do
-  subject(:config) { SecureHeaders::Configuration.new }
-
-  describe '.apply_defaults' do
-    before { described_class.apply_defaults(config) }
-
-    it 'returns the same configuration object it was given' do
-      expect(described_class.apply_defaults(config)).to equal(config)
-    end
-
-    it 'relaxes the default cookie samesite restriction for LTI iframes' do
-      expect(config.cookies).to eq(samesite: { none: true })
-    end
-
-    it 'does not mark cookies secure outside of production' do
-      expect(config.cookies[:secure]).to be_nil
-    end
-
-    it 'allows the app to be embedded in LTI iframes' do
-      expect(config.x_frame_options).to eq('ALLOWALL')
-    end
-
-    it 'sets baseline browser protection headers' do
-      expect(config.x_content_type_options).to eq('nosniff')
-      expect(config.x_xss_protection).to eq('1; mode=block')
-      expect(config.referrer_policy).to eq(%w(origin-when-cross-origin strict-origin-when-cross-origin))
-    end
-
-    it 'restricts default_src, connect_src, and script_src to self' do
-      expect(config.csp[:default_src]).to include("'self'")
-      expect(config.csp[:connect_src]).to include("'self'")
-      expect(config.csp[:script_src]).to include("'self'")
-    end
-
-    it 'allows inline styles and Google Fonts for CSS-in-JS libraries' do
-      expect(config.csp[:style_src]).to include("'self'", "'unsafe-inline'", 'blob:', 'https://fonts.googleapis.com')
-      expect(config.csp[:font_src]).to include("'self'", 'data:', 'https://fonts.gstatic.com')
-    end
-
-    it 'does not add development-only CSP allowances outside of development' do
-      expect(config.csp[:script_src]).not_to include("'unsafe-eval'")
-      expect(config.csp[:connect_src]).not_to include('http://localhost:3035')
-    end
-  end
-
-  describe '.apply_defaults in production' do
-    around do |example|
-      original_env = Rails.env
-      begin
-        Rails.env = 'production'
-        example.run
-      ensure
-        Rails.env = original_env
-      end
-    end
-
-    it 'marks cookies as secure' do
-      described_class.apply_defaults(config)
-      expect(config.cookies[:secure]).to be true
-    end
-  end
-
-  describe '.csp_entry' do
-    it 'merges values into the directive without duplicating existing entries' do
-      config.csp[:default_src] = ["'self'"]
-      described_class.instance_variable_set(:@config, config)
-
-      described_class.send(:csp_entry, :default_src, "'self'", 'https://example.com')
-
-      expect(config.csp[:default_src]).to eq(["'self'", 'https://example.com'])
-    ensure
-      described_class.instance_variable_set(:@config, nil)
-    end
-  end
-end

data/spec/lib/panda_pal/helpers/session_replacement_spec.rb

@@ -1,72 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe PandaPal::Helpers::SessionReplacement do
-  let(:organization) { create(:panda_pal_organization) }
-  let(:session) { PandaPal::Session.create!(panda_pal_organization: organization, data: {}) }
-
-  let(:host_class) do
-    Class.new do
-      # Stub the concern's controller-only class macros.
-      def self.helper_method(*args); end
-      def self.prepend_around_action(*args); end
-
-      include PandaPal::Helpers::SessionReplacement
-
-      attr_reader :current_organization, :current_session
-
-      def initialize(organization, session)
-        @current_organization = organization
-        @current_session = session
-      end
-
-      def request
-        @request ||= Struct.new(:remote_ip).new('127.0.0.1')
-      end
-    end
-  end
-
-  subject(:controller) { host_class.new(organization, session) }
-
-  def decoded_payload(token)
-    JSON.parse(Base64.urlsafe_decode64(token.split('.').first))
-  end
-
-  describe '#link_nonce' do
-    it 'returns the same real payload on repeated calls within one request' do
-      first = controller.link_nonce(type: :nonce)
-      second = controller.link_nonce(type: :nonce)
-      third = controller.link_nonce(type: :nonce)
-
-      [first, second, third].each do |token|
-        expect(token.split('.').first).not_to eq(Base64.urlsafe_encode64('null'))
-        payload = decoded_payload(token)
-        expect(payload['typ']).to eq('T-NONCE')
-        expect(payload['o']).to eq(organization.id)
-        expect(payload['s']).to eq(session.id)
-        expect(payload['nnc']).to be_present
-      end
-
-      expect(second).to eq(first)
-      expect(third).to eq(first)
-    end
-
-    it 'builds a T-URI payload with the org and session the verifier requires' do
-      token = controller.link_nonce('https://example.test/a/b', type: :url)
-
-      payload = decoded_payload(token)
-      expect(payload['typ']).to eq('T-URI')
-      expect(payload['o']).to eq(organization.id)
-      expect(payload['s']).to eq(session.id)
-      expect(payload['usig']).to be_present
-    end
-
-    it 'still caches one nonce per type per request rather than rotating it' do
-      controller.link_nonce(type: :nonce)
-      nonce_after_first = session[:link_nonce]
-
-      controller.link_nonce(type: :nonce)
-
-      expect(session[:link_nonce]).to eq(nonce_after_first)
-    end
-  end
-end

data/spec/models/panda_pal/api_call_spec.rb

@@ -1,30 +0,0 @@
-require 'spec_helper'
-
-module PandaPal
-  RSpec.describe ApiCall, type: :model do
-    let!(:subject) { ApiCall.create!(logic: '"#{p[:foo]}_bar"') }
-    let!(:jwt) { subject.jwt_token }
-
-    describe ".from_jwt" do
-      it "finds an ApiCall from a JWT" do
-        expect(ApiCall.from_jwt(jwt)).to eq subject
-      end
-
-      it "fails if the JWT is invalid" do
-        expect{ ApiCall.from_jwt("really.bad.jwt") }.to raise_error(JWT::DecodeError)
-      end
-    end
-
-    describe "#call" do
-      it "calls the function with parameters" do
-        expect(subject.call({ foo: 'FOO' })).to eq 'FOO_bar'
-      end
-    end
-
-    describe "#call_url" do
-      it "generates a URL with the expected placholders" do
-        expect(subject.call_url).to eq "/panda_pal/call_logic?foo=TODO&token=#{jwt}"
-      end
-    end
-  end
-end