panda_pal 5.18.2 → 5.19.0.beta2

data/spec/models/panda_pal/session_spec.rb

@@ -1,202 +0,0 @@
-require 'spec_helper'
-
-module PandaPal
-  RSpec.describe Session, type: :model do
-    it 'is initialized with a session_secret' do
-      expect(PandaPal::Session.new.session_secret).to_not be_nil
-    end
-
-    describe '#dup' do
-      # Mirrors validate_v1p3_launch: load the login session, delete it, dup it into
-      # the org's tenant. Only fails on Rails 8.0 with partial_inserts left on, so it
-      # is the appraisal run that gates this, not the default (Rails 8.1) lockfile.
-      it 'persists every attribute, including session_secret, on the duped record' do
-        original = PandaPal::Session.find(create(:panda_pal_session).id)
-        original_secret = original.session_secret
-        original.delete
-
-        with_partial_inserts(true) do
-          duped = original.dup
-          duped.save!
-
-          reloaded = PandaPal::Session.find(duped.id)
-          expect(reloaded.session_secret).to eq(original_secret)
-        end
-      end
-
-      # Rails 7.0 split partial_writes into partial_inserts/partial_updates; on 6.1
-      # the single partial_writes flag is what controls the INSERT.
-      def with_partial_inserts(value)
-        setting = PandaPal::Session.respond_to?(:partial_inserts) ? 'partial_inserts' : 'partial_writes'
-        previous = PandaPal::Session.public_send(setting)
-        PandaPal::Session.public_send("#{setting}=", value)
-        yield
-      ensure
-        PandaPal::Session.public_send("#{setting}=", previous) unless previous.nil?
-      end
-    end
-
-    describe Session::RoleStore do
-      it 'parses an LTI 1.1 (URN-style) institution role' do
-        role_store = Session::RoleStore.new('urn:lti:instrole:ims/lis/Administrator')
-        expect(role_store.institution_roles).to eq(['administrator'])
-      end
-
-      it 'parses an LTI 1.1 (URN-style) system role' do
-        role_store = Session::RoleStore.new('urn:lti:sysrole:ims/lis/SysAdmin')
-        expect(role_store.system_roles).to eq(['sys_admin'])
-      end
-
-      it 'parses an LTI 1.3 (URL-style) institution role' do
-        role_store = Session::RoleStore.new(['http://purl.imsglobal.org/vocab/lis/v2/institution/person#Administrator'])
-        expect(role_store.institution_roles).to eq(['administrator'])
-      end
-    end
-
-    describe '.for_panda_token' do
-      it 'returns nil for a nil token' do
-        expect(Session.for_panda_token(nil)).to be_nil
-      end
-
-      it 'returns nil for an empty token' do
-        expect(Session.for_panda_token('')).to be_nil
-      end
-
-      context 'with a KEY-type token' do
-        let(:session) { create(:panda_pal_session) }
-
-        it 'returns the matching session record' do
-          found = Session.for_panda_token(session.session_key, enforce_tenant: false)
-          expect(found).to eq(session)
-        end
-
-        it 'raises SessionNonceMismatch when the secret in the signature is wrong' do
-          header, _sig = session.session_key.split('.')
-          tampered_token = "#{header}.not-the-real-secret"
-
-          expect {
-            Session.for_panda_token(tampered_token, enforce_tenant: false)
-          }.to raise_error(Session::SessionNonceMismatch)
-        end
-
-        it 'raises SessionNonceMismatch when the payload session id does not match the found record' do
-          other_session = create(:panda_pal_session)
-
-          header, sig = session.session_key.split('.')
-          payload = JSON.parse(Base64.urlsafe_decode64(header))
-          payload['s'] = other_session.id
-          tampered_header = Base64.urlsafe_encode64(payload.to_json)
-          tampered_token = "#{tampered_header}.#{sig}"
-
-          expect {
-            Session.for_panda_token(tampered_token, enforce_tenant: false)
-          }.to raise_error(Session::SessionNonceMismatch)
-        end
-      end
-    end
-
-    describe '#sign_value / #validate_signature' do
-      it 'produces a base64-encoded HMAC-SHA256 digest without relying on OpenSSL::HMAC.base64digest' do
-        session = build(:panda_pal_session)
-
-        # OpenSSL::HMAC.base64digest doesn't exist at all on some Rubies' bundled
-        # openssl gem (that's the bug this test guards against) -- only assert the
-        # negative expectation where the method exists to negate; the correctness
-        # check below is what actually proves sign_value doesn't depend on it.
-        expect(OpenSSL::HMAC).not_to receive(:base64digest) if OpenSSL::HMAC.respond_to?(:base64digest)
-        signature = session.sign_value('some-data-to-sign')
-
-        expected = Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), session.session_secret, 'some-data-to-sign'))
-        expect(signature).to eq(expected)
-      end
-
-      it 'validates a signature produced by the same session' do
-        session = build(:panda_pal_session)
-        signature = session.sign_value('some-data-to-sign')
-
-        expect(session.validate_signature('some-data-to-sign', signature)).to be true
-      end
-
-      it 'does not validate a signature produced by a different session' do
-        session = build(:panda_pal_session)
-        other_session = build(:panda_pal_session)
-
-        signature_from_other = other_session.sign_value('some-data-to-sign')
-
-        expect(session.validate_signature('some-data-to-sign', signature_from_other)).to be false
-      end
-    end
-
-    describe '.extract_panda_token' do
-      it 'extracts the token from the X-Panda-Token header (HTTP_ form)' do
-        request = double('request', headers: { 'HTTP_X_PANDA_TOKEN' => 'header.token' })
-        expect(Session.extract_panda_token(request, {})).to eq('header.token')
-      end
-
-      it 'extracts the token from the X-Panda-Token header (raw form)' do
-        request = double('request', headers: { 'X-Panda-Token' => 'header.token' })
-        expect(Session.extract_panda_token(request, {})).to eq('header.token')
-      end
-
-      it 'falls back to request.env when the request does not respond to headers' do
-        request = double('request', env: { 'HTTP_X_PANDA_TOKEN' => 'env.token' })
-        expect(Session.extract_panda_token(request, {})).to eq('env.token')
-      end
-
-      it 'extracts the token from an "Authorization: Bearer panda:<token>" header' do
-        request = double('request', headers: { 'HTTP_AUTHORIZATION' => 'Bearer panda:bearer.token' })
-        expect(Session.extract_panda_token(request, {})).to eq('bearer.token')
-      end
-
-      it 'extracts the token from the raw Authorization header key' do
-        request = double('request', headers: { 'Authorization' => 'Bearer panda:bearer.token' })
-        expect(Session.extract_panda_token(request, {})).to eq('bearer.token')
-      end
-
-      it 'extracts the token from the legacy "Authorization: token=<token>" header format' do
-        request = double('request', headers: { 'HTTP_AUTHORIZATION' => 'token=legacy.token' })
-        expect(Session.extract_panda_token(request, {})).to eq('legacy.token')
-      end
-
-      it 'extracts the token from params["panda_token"]' do
-        request = double('request', headers: {})
-        expect(Session.extract_panda_token(request, { 'panda_token' => 'params.token' })).to eq('params.token')
-      end
-
-      it 'extracts the token from the legacy params["session_token"]' do
-        request = double('request', headers: {})
-        expect(Session.extract_panda_token(request, { 'session_token' => 'legacy.session.token' })).to eq('legacy.session.token')
-      end
-
-      it 'extracts the token from the legacy params["session_key"]' do
-        request = double('request', headers: {})
-        expect(Session.extract_panda_token(request, { 'session_key' => 'legacy.session.key.token' })).to eq('legacy.session.key.token')
-      end
-
-      it 'returns nil when nothing is present' do
-        request = double('request', headers: {})
-        expect(Session.extract_panda_token(request, {})).to be_nil
-      end
-    end
-
-    describe '.format_url_for_signing' do
-      it 'strips panda_token, session_key, and session_token but keeps other params' do
-        url = 'https://example.com/some/path?panda_token=tok&foo=bar&session_key=abc&baz=qux&session_token=def'
-
-        expect(Session.format_url_for_signing(url)).to eq('/some/path?foo=bar&baz=qux')
-      end
-
-      it 'accepts a URI object directly' do
-        uri = URI.parse('https://example.com/some/path?panda_token=tok&foo=bar')
-
-        expect(Session.format_url_for_signing(uri)).to eq('/some/path?foo=bar')
-      end
-
-      it 'produces an empty query string when no params remain' do
-        url = 'https://example.com/some/path?panda_token=tok'
-
-        expect(Session.format_url_for_signing(url)).to eq('/some/path?')
-      end
-    end
-  end
-end

data/spec/spec_helper.rb

@@ -1,158 +0,0 @@
-# ENV["RAILS_ENV"] ||= 'test'
-
-if ENV['COVERAGE']
-  require 'simplecov'
-  SimpleCov.start do
-    add_filter '/spec/'
-  end
-end
-
-require 'bundler'
-Bundler.require :default, :development
-
-Combustion.initialize! :active_record, :active_job, :action_controller
-
-require 'sidekiq'
-require 'sidekiq/rails'
-require 'sidekiq/testing'
-require 'sidekiq-scheduler'
-
-require 'rspec/rails'
-require 'rspec/autorun'
-require 'nokogiri'
-require 'factory_bot_rails'
-
-require "panda_pal/spec_helper"
-
-ActiveRecord::Schema.verbose = false
-
-Dir[File.dirname(__FILE__) + "/factories/**/*.rb"].each {|f| require f }
-
-RSpec.configure do |config|
-  config.include PandaPal::SpecHelper
-  config.include FactoryBot::Syntax::Methods
-
-  config.before(:each) do
-    allow_any_instance_of(PandaPal::Organization).to receive(:create_schema).and_wrap_original do |m, *args|
-      org = m.receiver
-      m.call(*args)
-      org.switch_tenant do
-        Combustion::Database::LoadSchema.call
-        Combustion::Database::Migrate.call
-      end
-    end
-  end
-
-  # rspec-expectations config goes here. You can use an alternate
-  # assertion/expectation library such as wrong or the stdlib/minitest
-  # assertions if you prefer.
-  config.expect_with :rspec do |expectations|
-    # This option will default to `true` in RSpec 4. It makes the `description`
-    # and `failure_message` of custom matchers include text for helper methods
-    # defined using `chain`, e.g.:
-    #     be_bigger_than(2).and_smaller_than(4).description
-    #     # => "be bigger than 2 and smaller than 4"
-    # ...rather than:
-    #     # => "be bigger than 2"
-    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
-  end
-
-  # rspec-mocks config goes here. You can use an alternate test double
-  # library (such as bogus or mocha) by changing the `mock_with` option here.
-  config.mock_with :rspec do |mocks|
-    # Prevents you from mocking or stubbing a method that does not exist on
-    # a real object. This is generally recommended, and will default to
-    # `true` in RSpec 4.
-    mocks.verify_partial_doubles = true
-  end
-
-  config.before(:each) do
-    PandaPal.lti_options = {
-      title: 'Test App',
-      settings_structure: {}
-    }
-  end
-
-  # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures.
-  # Rails 7.1+ uses the plural fixture_paths (array); earlier versions use the
-  # singular fixture_path (string).
-  fixtures_dir = "#{::Rails.root}/spec/fixtures"
-  if config.respond_to?(:fixture_paths=)
-    config.fixture_paths |= [fixtures_dir]
-  else
-    config.fixture_path = fixtures_dir
-  end
-
-  # If you're not using ActiveRecord, or you'd prefer not to run each of your
-  # examples within a transaction, remove the following line or assign false
-  # instead of true.
-  config.use_transactional_fixtures = true
-
-  # RSpec Rails can automatically mix in different behaviours to your tests
-  # based on their file location, for example enabling you to call `get` and
-  # `post` in specs under `spec/controllers`.
-  #
-  # You can disable this behaviour by removing the line below, and instead
-  # explicitly tag your specs with their type, e.g.:
-  #
-  #     RSpec.describe UsersController, :type => :controller do
-  #       # ...
-  #     end
-  #
-  # The different available types are documented in the features, such as in
-  # https://relishapp.com/rspec/rspec-rails/docs
-  config.infer_spec_type_from_file_location!
-
-  # Filter lines from Rails gems in backtraces.
-  config.filter_rails_from_backtrace!
-
-# The settings below are suggested to provide a good initial experience
-# with RSpec, but feel free to customize to your heart's content.
-=begin
-  # These two settings work together to allow you to limit a spec run
-  # to individual examples or groups you care about by tagging them with
-  # `:focus` metadata. When nothing is tagged with `:focus`, all examples
-  # get run.
-  config.filter_run :focus
-  config.run_all_when_everything_filtered = true
-
-  # Allows RSpec to persist some state between runs in order to support
-  # the `--only-failures` and `--next-failure` CLI options. We recommend
-  # you configure your source control system to ignore this file.
-  config.example_status_persistence_file_path = "spec/examples.txt"
-
-  # Limits the available syntax to the non-monkey patched syntax that is
-  # recommended. For more details, see:
-  #   - http://rspec.info/blog/2012/06/rspecs-new-expectation-syntax/
-  #   - http://www.teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/
-  #   - http://rspec.info/blog/2014/05/notable-changes-in-rspec-3/#zero-monkey-patching-mode
-  config.disable_monkey_patching!
-
-  # Many RSpec users commonly either run the entire suite or an individual
-  # file, and it's useful to allow more verbose output when running an
-  # individual spec file.
-  if config.files_to_run.one?
-    # Use the documentation formatter for detailed output,
-    # unless a formatter has already been configured
-    # (e.g. via a command-line flag).
-    config.default_formatter = 'doc'
-  end
-
-  # Print the 10 slowest examples and example groups at the
-  # end of the spec run, to help surface which specs are running
-  # particularly slow.
-  config.profile_examples = 10
-
-  # Run specs in random order to surface order dependencies. If you find an
-  # order dependency and want to debug it, you can fix the order by providing
-  # the seed, which is printed after each run.
-  #     --seed 1234
-  config.order = :random
-
-  # Seed global randomization in this process using the `--seed` CLI option.
-  # Setting this allows you to use `--seed` to deterministically reproduce
-  # test failures related to randomization by passing the same `--seed` value
-  # as the one that triggered the failure.
-  Kernel.srand config.seed
-=end
-end