panda_pal 5.18.2 → 5.19.0.beta2

data/spec/models/panda_pal/platform_spec.rb

@@ -1,349 +0,0 @@
-require 'spec_helper'
-
-module PandaPal
-  RSpec.describe Platform, type: :model do
-    describe '.resolve_platform / .resolve_platform_class' do
-      context 'with the default configuration (no :platform option set)' do
-        it 'resolves to the Canvas platform class' do
-          expect(Platform.resolve_platform_class(iss: 'https://canvas.instructure.com')).to eq(Platform::Canvas)
-        end
-
-        it 'resolves to an instance of the Canvas platform, initialized with the issuer' do
-          resolved = Platform.resolve_platform(iss: 'https://canvas.instructure.com')
-
-          expect(resolved).to be_a(Platform::Canvas)
-          expect(resolved.platform_uri).to eq('https://canvas.instructure.com')
-        end
-      end
-
-      context 'when :platform is configured as a class name string' do
-        before do
-          PandaPal.lti_options = PandaPal.lti_options.merge(platform: 'PandaPal::Platform::Generic')
-        end
-
-        it 'resolves to that class' do
-          expect(Platform.resolve_platform_class(iss: 'https://lms.example.com')).to eq(Platform::Generic)
-        end
-
-        it 'resolves to an instance of that class' do
-          resolved = Platform.resolve_platform(iss: 'https://lms.example.com')
-          expect(resolved).to be_a(Platform::Generic)
-        end
-      end
-
-      context 'when :platform is configured as a Proc' do
-        it 'uses the class returned by the proc' do
-          PandaPal.lti_options = PandaPal.lti_options.merge(
-            platform: proc { |params| params[:iss] == 'https://special.example.com' ? Platform::Generic : nil }
-          )
-
-          expect(Platform.resolve_platform_class(iss: 'https://special.example.com')).to eq(Platform::Generic)
-        end
-
-        it 'falls through to the trusted-issuer default when the proc returns nil' do
-          PandaPal.lti_options = PandaPal.lti_options.merge(platform: proc { |_params| nil })
-
-          expect(Platform.resolve_platform_class(iss: 'https://canvas.beta.instructure.com')).to eq(Platform::Canvas)
-        end
-      end
-
-      context 'when :platform is configured as a Symbol' do
-        before do
-          Object.define_singleton_method(:panda_pal_spec_platform_resolver) { |_params| Platform::Generic }
-          PandaPal.lti_options = PandaPal.lti_options.merge(platform: :panda_pal_spec_platform_resolver)
-        end
-
-        after do
-          Object.singleton_class.send(:remove_method, :panda_pal_spec_platform_resolver)
-        end
-
-        it 'calls the named method on Object and uses the returned class' do
-          expect(Platform.resolve_platform_class(iss: 'https://lms.example.com')).to eq(Platform::Generic)
-        end
-      end
-
-      context 'when the configured platform string does not resolve to a class' do
-        before do
-          PandaPal.lti_options = PandaPal.lti_options.merge(platform: 'NotARealPlatformClassXYZ')
-        end
-
-        it 'falls back to Canvas for a trusted Canvas issuer' do
-          expect(Platform.resolve_platform_class(iss: 'https://canvas.beta.instructure.com')).to eq(Platform::Canvas)
-        end
-
-        it 'raises for an untrusted issuer' do
-          expect {
-            Platform.resolve_platform_class(iss: 'https://not-trusted.example.com')
-          }.to raise_error(RuntimeError, /Unknown platform/)
-        end
-      end
-    end
-
-    describe Platform::Generic do
-      describe '.from_urls' do
-        it 'stores the given URLs for later use' do
-          platform = described_class.from_urls(
-            'https://lms.example.com',
-            jwks: '/custom/jwks',
-            auth_redirect: '/custom/auth',
-            grant: '/custom/grant'
-          )
-
-          expect(platform.options).to eq(
-            base_url: 'https://lms.example.com',
-            jwks_url: '/custom/jwks',
-            auth_redirect_url: '/custom/auth',
-            grant_url: '/custom/grant'
-          )
-        end
-
-        it 'derives platform_uri from base_url' do
-          platform = described_class.from_urls('https://lms.example.com')
-
-          expect(platform.platform_uri).to eq('https://lms.example.com')
-        end
-
-        it 'derives jwks_url from base_url, using the default path when none given' do
-          platform = described_class.from_urls('https://lms.example.com')
-
-          expect(platform.jwks_url).to eq('https://lms.example.com/api/lti/security/jwks')
-        end
-
-        it 'derives jwks_url from a custom path when given' do
-          platform = described_class.from_urls('https://lms.example.com', jwks: '/custom/jwks')
-
-          expect(platform.jwks_url).to eq('https://lms.example.com/custom/jwks')
-        end
-
-        it 'derives authentication_redirect_url from base_url, using the default path when none given' do
-          platform = described_class.from_urls('https://lms.example.com')
-
-          expect(platform.authentication_redirect_url).to eq('https://lms.example.com/api/lti/authorize_redirect')
-        end
-
-        it 'derives grant_url from base_url, using the default path when none given' do
-          platform = described_class.from_urls('https://lms.example.com')
-
-          expect(platform.grant_url).to eq('https://lms.example.com/login/oauth2/token')
-        end
-      end
-    end
-
-    describe '#serialize / .from_serialized' do
-      it 'round-trips a Canvas platform' do
-        platform = Platform::Canvas.new(iss: 'https://canvas.instructure.com')
-        restored = Platform.from_serialized(platform.serialize)
-
-        expect(restored).to be_a(Platform::Canvas)
-        expect(restored.platform_uri).to eq(platform.platform_uri)
-        expect(restored.jwks_url).to eq(platform.jwks_url)
-      end
-
-      it 'round-trips a Generic platform' do
-        platform = Platform::Generic.from_urls('https://lms.example.com', jwks: '/custom/jwks')
-        restored = Platform.from_serialized(platform.serialize)
-
-        expect(restored).to be_a(Platform::Generic)
-        expect(restored.platform_uri).to eq(platform.platform_uri)
-        expect(restored.jwks_url).to eq(platform.jwks_url)
-      end
-    end
-    describe 'LTI Advantage service tokens' do
-      let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
-      let(:platform) { Platform::Canvas.new(iss: 'https://canvas.instructure.com') }
-      let(:grant_url) { 'https://sso.canvaslms.com/login/oauth2/token' }
-      let(:client_id) { '10000000000042' }
-      let(:score_scope) { LtiConstants::AgsScopes::SCORE }
-      let(:cache) { ActiveSupport::Cache::MemoryStore.new }
-
-      before do
-        PandaPal.lti_private_key = rsa_key
-        PandaPal.jwk = nil
-        allow(Rails).to receive(:cache).and_return(cache)
-      end
-
-      after do
-        PandaPal.lti_private_key = nil
-        PandaPal.jwk = nil
-      end
-
-      def http_response(code, body = '', headers = {})
-        double('HTTParty::Response', code: code, success?: (200..299).cover?(code), body: body, headers: headers)
-      end
-
-      def token_response(token, expires_in: 3600)
-        http_response(200, { access_token: token, token_type: 'Bearer', expires_in: expires_in }.to_json)
-      end
-
-      describe '#service_access_token' do
-        it 'posts a client_credentials grant with an RS256 client assertion signed by the tool key' do
-          captured = nil
-          allow(HTTParty).to receive(:post) do |url, **options|
-            captured = { url: url, options: options }
-            token_response('service-token')
-          end
-
-          token = platform.service_access_token(client_id: client_id, scopes: [score_scope])
-
-          expect(token).to eq('service-token')
-          expect(captured[:url]).to eq(grant_url)
-
-          body = captured[:options][:body]
-          expect(body[:grant_type]).to eq('client_credentials')
-          expect(body[:client_assertion_type]).to eq('urn:ietf:params:oauth:client-assertion-type:jwt-bearer')
-          expect(body[:scope]).to eq(score_scope)
-
-          payload, header = JWT.decode(body[:client_assertion], rsa_key.public_key, true, algorithm: 'RS256')
-          expect(header['alg']).to eq('RS256')
-          expect(header['kid']).to eq(PandaPal.jwk.kid)
-          expect(payload['iss']).to eq(client_id)
-          expect(payload['sub']).to eq(client_id)
-          expect(payload['aud']).to eq(grant_url)
-          expect(payload['jti']).to be_present
-          expect(payload['exp'] - payload['iat']).to eq(300)
-          expect(payload['iat']).to be_within(5).of(Time.now.to_i)
-        end
-
-        it 'joins several scopes with spaces' do
-          expect(HTTParty).to receive(:post).with(grant_url, hash_including(
-            body: hash_including(scope: [LtiConstants::AgsScopes::LINEITEM_READONLY, score_scope].sort.join(' '))
-          )).and_return(token_response('service-token'))
-
-          platform.service_access_token(client_id: client_id, scopes: [score_scope, LtiConstants::AgsScopes::LINEITEM_READONLY])
-        end
-
-        it 'bounds the request with timeouts' do
-          expect(HTTParty).to receive(:post).with(grant_url, hash_including(open_timeout: 5, read_timeout: 15))
-            .and_return(token_response('service-token'))
-
-          platform.service_access_token(client_id: client_id, scopes: [score_scope])
-        end
-
-        it 'reuses the cached token for the same client and scopes' do
-          expect(HTTParty).to receive(:post).once.and_return(token_response('service-token'))
-
-          2.times { expect(platform.service_access_token(client_id: client_id, scopes: [score_scope])).to eq('service-token') }
-        end
-
-        it 'requests a separate token for a different scope set' do
-          expect(HTTParty).to receive(:post).twice.and_return(token_response('score-token'), token_response('lineitem-token'))
-
-          expect(platform.service_access_token(client_id: client_id, scopes: [score_scope])).to eq('score-token')
-          expect(platform.service_access_token(client_id: client_id, scopes: [LtiConstants::AgsScopes::LINEITEM])).to eq('lineitem-token')
-        end
-
-        it 'caches the token for its expires_in less a minute' do
-          allow(HTTParty).to receive(:post).and_return(token_response('service-token', expires_in: 600))
-          expect(cache).to receive(:write).with(kind_of(String), 'service-token', expires_in: 540.seconds).and_call_original
-
-          platform.service_access_token(client_id: client_id, scopes: [score_scope])
-        end
-
-        it 'does not cache the key under the token or the assertion' do
-          allow(HTTParty).to receive(:post).and_return(token_response('service-token'))
-          expect(cache).to receive(:write).with(%r{\Apanda_pal/lti_service_tokens/[0-9a-f]{64}\z}, anything, anything)
-
-          platform.service_access_token(client_id: client_id, scopes: [score_scope])
-        end
-
-        it 'fetches a new token when forced' do
-          expect(HTTParty).to receive(:post).twice.and_return(token_response('first'), token_response('second'))
-
-          platform.service_access_token(client_id: client_id, scopes: [score_scope])
-          expect(platform.service_access_token(client_id: client_id, scopes: [score_scope], force: true)).to eq('second')
-        end
-
-        it 'raises ServiceTokenError with the status, without echoing the response body, on a non-2xx answer' do
-          allow(HTTParty).to receive(:post).and_return(http_response(400, '{"error":"invalid_client","assertion":"secret-assertion"}'))
-
-          expect {
-            platform.service_access_token(client_id: client_id, scopes: [score_scope])
-          }.to raise_error(Platform::ServiceTokenError) { |error|
-            expect(error.status).to eq(400)
-            expect(error.message).to eq('token request answered 400')
-            expect(error).to be_a(PandaPal::LtiServiceError)
-          }
-        end
-
-        it 'raises ServiceTokenError when the response has no access_token' do
-          allow(HTTParty).to receive(:post).and_return(http_response(200, '{"token_type":"Bearer"}'))
-
-          expect {
-            platform.service_access_token(client_id: client_id, scopes: [score_scope])
-          }.to raise_error(Platform::ServiceTokenError, /no access_token/)
-        end
-
-        it 'wraps network errors in LtiServiceError' do
-          allow(HTTParty).to receive(:post).and_raise(Net::OpenTimeout)
-
-          expect {
-            platform.service_access_token(client_id: client_id, scopes: [score_scope])
-          }.to raise_error(PandaPal::LtiServiceError, 'token request failed: Net::OpenTimeout')
-        end
-
-        it 'uses the Generic platform grant_url' do
-          generic = Platform::Generic.from_urls('https://lms.example.com', grant: '/oauth/token')
-          expect(HTTParty).to receive(:post).with('https://lms.example.com/oauth/token', anything).and_return(token_response('generic-token'))
-
-          expect(generic.service_access_token(client_id: client_id, scopes: [score_scope])).to eq('generic-token')
-        end
-      end
-
-      describe '#expire_service_access_token' do
-        it 'drops the cached token so the next call requests a new one' do
-          expect(HTTParty).to receive(:post).twice.and_return(token_response('first'), token_response('second'))
-
-          platform.service_access_token(client_id: client_id, scopes: [score_scope])
-          platform.expire_service_access_token(client_id: client_id, scopes: [score_scope])
-
-          expect(platform.service_access_token(client_id: client_id, scopes: [score_scope])).to eq('second')
-        end
-      end
-
-      describe '#service_request' do
-        let(:url) { 'https://canvas.example.com/api/lti/courses/1/line_items/2/scores' }
-
-        it 'sends the bearer token with the given headers and body' do
-          allow(HTTParty).to receive(:post).with(grant_url, anything).and_return(token_response('service-token'))
-          expect(HTTParty).to receive(:post).with(url, hash_including(
-            headers: { 'Content-Type' => 'application/json', 'Authorization' => 'Bearer service-token' },
-            body: '{}',
-            open_timeout: 5,
-          )).and_return(http_response(200))
-
-          response = platform.service_request(:post, url, client_id: client_id, scopes: [score_scope],
-            headers: { 'Content-Type' => 'application/json' }, body: '{}')
-
-          expect(response.code).to eq(200)
-        end
-
-        it 'retries once with a new token when a cached token is refused with a 401' do
-          cache.write(platform.send(:service_token_cache_key, client_id, [score_scope]), 'stale-token')
-          expect(HTTParty).to receive(:post).with(grant_url, anything).once.and_return(token_response('fresh-token'))
-          expect(HTTParty).to receive(:post).with(url, hash_including(headers: { 'Authorization' => 'Bearer stale-token' })).and_return(http_response(401))
-          expect(HTTParty).to receive(:post).with(url, hash_including(headers: { 'Authorization' => 'Bearer fresh-token' })).and_return(http_response(200))
-
-          response = platform.service_request(:post, url, client_id: client_id, scopes: [score_scope])
-
-          expect(response.code).to eq(200)
-          expect(cache.read(platform.send(:service_token_cache_key, client_id, [score_scope]))).to eq('fresh-token')
-        end
-
-        it 'does not retry when a freshly issued token is refused' do
-          expect(HTTParty).to receive(:post).with(grant_url, anything).once.and_return(token_response('fresh-token'))
-          expect(HTTParty).to receive(:post).with(url, anything).once.and_return(http_response(401))
-
-          expect(platform.service_request(:post, url, client_id: client_id, scopes: [score_scope]).code).to eq(401)
-        end
-
-        it 'returns the second 401 when the refreshed token is refused too' do
-          cache.write(platform.send(:service_token_cache_key, client_id, [score_scope]), 'stale-token')
-          allow(HTTParty).to receive(:post).with(grant_url, anything).and_return(token_response('fresh-token'))
-          expect(HTTParty).to receive(:post).with(url, anything).twice.and_return(http_response(401))
-
-          expect(platform.service_request(:post, url, client_id: client_id, scopes: [score_scope]).code).to eq(401)
-        end
-      end
-    end
-  end
-end

data/spec/models/panda_pal/session_account_roles_spec.rb

@@ -1,182 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-module PandaPal
-  RSpec.describe Session, type: :model do
-    describe '#canvas_account_role_labels' do
-      # The Tool is installed on a SUB-ACCOUNT here, which is the only topology
-      # that distinguishes the install Account from Canvas's own root. A Tool
-      # installed at the top is the degenerate case where every reading of
-      # "root" agrees, so it can't tell a correct implementation from a broken
-      # one.
-      #
-      #   1 root
-      #   └── 20 parent
-      #       └── 300 install   <- current_organization.canvas_account_id
-      #           └── 4000 child
-      #   └── 21 sibling
-      let(:canvas_user_id) { 9001 }
-      let!(:organization) { create(:panda_pal_organization, canvas_account_id: 300) }
-      # Created BEFORE the tenant switch below: panda_pal_sessions lives outside
-      # the tenant schema, while accounts/admins live inside it.
-      let!(:session) do
-        create(:panda_pal_session, panda_pal_organization: organization, data: {
-          launch_params: {
-            "https://purl.imsglobal.org/spec/lti/claim/custom" => { "canvas_user_id" => canvas_user_id },
-          },
-        })
-      end
-
-      def admin!(account_id, role_name: "AccountAdmin", workflow_state: "active")
-        Admin.create!(canvas_user_id: canvas_user_id, canvas_account_id: account_id,
-                      role_name: role_name, workflow_state: workflow_state)
-      end
-
-      before do
-        organization.switch_tenant
-        Account.create!(canvas_id: 1,    canvas_parent_account_id: nil, name: "root")
-        Account.create!(canvas_id: 20,   canvas_parent_account_id: 1,   name: "parent")
-        Account.create!(canvas_id: 21,   canvas_parent_account_id: 1,   name: "sibling")
-        Account.create!(canvas_id: 300,  canvas_parent_account_id: 20,  name: "install")
-        Account.create!(canvas_id: 4000, canvas_parent_account_id: 300, name: "child")
-      end
-
-      after { Apartment::Tenant.reset }
-
-      context 'by default (inherited: false)' do
-        it 'returns roles held at the install Account' do
-          admin!(300, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels).to eq(["AccountAdmin"])
-        end
-
-        it 'ignores roles held above the install Account' do
-          admin!(1, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels).to eq([])
-        end
-
-        it 'treats :root as the install Account, not as Canvas account 1' do
-          admin!(300, role_name: "Ops")
-          admin!(1, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(:root)).to eq(["Ops"])
-        end
-
-        it 'reads an explicitly requested Account' do
-          admin!(4000, role_name: "Sub-Account Admin")
-
-          expect(session.canvas_account_role_labels(4000)).to eq(["Sub-Account Admin"])
-        end
-      end
-
-      context 'with inherited: true' do
-        it 'includes a role held on the immediate parent' do
-          admin!(20, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(inherited: true)).to eq(["AccountAdmin"])
-        end
-
-        it 'includes a role held on Canvas\'s root Account, several levels up' do
-          admin!(1, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(:root, inherited: true)).to eq(["AccountAdmin"])
-        end
-
-        it 'still includes a role held at the Account itself' do
-          admin!(300, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(inherited: true)).to eq(["AccountAdmin"])
-        end
-
-        it 'does NOT include a role held BELOW the Account' do
-          admin!(4000, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
-        end
-
-        it 'does NOT include a role held on a sibling branch' do
-          admin!(21, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
-        end
-
-        it 'excludes inactive rows anywhere in the chain' do
-          admin!(1, role_name: "AccountAdmin", workflow_state: "inactive")
-
-          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
-        end
-
-        it 'ignores another user\'s roles in the chain' do
-          Admin.create!(canvas_user_id: canvas_user_id + 1, canvas_account_id: 1, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(inherited: true)).to eq([])
-        end
-
-        it 'gathers roles from several levels at once' do
-          admin!(300, role_name: "Ops")
-          admin!(20,  role_name: "Department Admin")
-          admin!(1,   role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(inherited: true))
-            .to contain_exactly("Ops", "Department Admin", "AccountAdmin")
-        end
-
-        it 'walks up from an explicitly requested Account, not from the install' do
-          admin!(300, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(4000, inherited: true)).to eq(["AccountAdmin"])
-        end
-
-        it 'accepts an Account-like object' do
-          admin!(1, role_name: "AccountAdmin")
-
-          expect(session.canvas_account_role_labels(Account.find_by(canvas_id: 300), inherited: true))
-            .to eq(["AccountAdmin"])
-        end
-      end
-    end
-
-    describe '#canvas_account_ancestry' do
-      let!(:organization) { create(:panda_pal_organization, canvas_account_id: 300) }
-      let!(:session) { create(:panda_pal_session, panda_pal_organization: organization, data: {}) }
-
-      before { organization.switch_tenant }
-      after { Apartment::Tenant.reset }
-
-      it 'returns the Account plus its ancestors, nearest first' do
-        Account.create!(canvas_id: 1,   canvas_parent_account_id: nil)
-        Account.create!(canvas_id: 20,  canvas_parent_account_id: 1)
-        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
-
-        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20, 1 ])
-      end
-
-      it 'returns just the Account when it is already the top' do
-        Account.create!(canvas_id: 1, canvas_parent_account_id: nil)
-
-        expect(session.canvas_account_ancestry(1)).to eq([ 1 ])
-      end
-
-      it 'returns the id unchanged when the Account is not in the local mirror' do
-        expect(session.canvas_account_ancestry(300)).to eq([ 300 ])
-      end
-
-      it 'stops rather than looping forever on a cyclic hierarchy' do
-        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
-        Account.create!(canvas_id: 20,  canvas_parent_account_id: 300)
-
-        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20 ])
-      end
-
-      it 'keeps walking through a deleted intermediate Account' do
-        Account.create!(canvas_id: 1,   canvas_parent_account_id: nil)
-        Account.create!(canvas_id: 20,  canvas_parent_account_id: 1, workflow_state: "deleted")
-        Account.create!(canvas_id: 300, canvas_parent_account_id: 20)
-
-        expect(session.canvas_account_ancestry(300)).to eq([ 300, 20, 1 ])
-      end
-    end
-  end
-end