panda_pal 5.19.0.beta1 → 5.19.0.beta2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36f3440bb369f482a622cca1b58dbe3857bd74749d53776be10e6b99e8bf3f79
-  data.tar.gz: 02c42332159e06ae1778d8155c2a58d230ae24dc82a5f1e0c6027aa7e0a9f274
+  metadata.gz: b8433b20262277ab9a0e66156b4fb2b865919cbfe73701202c163b1dd4c063c9
+  data.tar.gz: fba4d18d40156ccf1799c33b4b2a5aed33b71c6e0e772a65df04c586f207503f
 SHA512:
-  metadata.gz: 9d4253dfec794377b88c5efbd6b2167b225373049e0e7b7694ef3f6f4d5e39253e71aa720094b39b336e6b4afc251b00c7f60f35dc1dbe3bb11dde35ce9b966b
-  data.tar.gz: b5004d4d2f7be4dcfb91d70d81445284084ea24a11f03f8db8513c6794cacdef99bf9c4da96c50b51cd1a9870ae4129ca3d66ac6b91a0065f4ef34e1aac59157
+  metadata.gz: 33e70423978afce311e1e0d4a5eecddc17e8814e922bea12e854b1b57135cc336e1c418b6f8d0fcca061c4a25485164dab1468805639d16abd6f1c1951f7b4cb
+  data.tar.gz: fa08843f3ad5d268203908c22725c546825102127cce6858c907a84b21e0a58561fab5f1e017b569cb95abd5e42c1715045b699b7790f899e7bbabfbf8f9693c

data/README.md

@@ -56,6 +56,19 @@ lti_nav editor_button: 'translate#editor_button', tool: :translate # Served at <
 
 - **Config:** each tool has its own config URL: `/v1p3/config?tool=translate` and `/v1p0/config?tool=translate`. The default tool's URLs are unchanged.
 - **Install:** `org.install_lti(host: ..., tool: :translate)`. On LTI 1.3 this creates (or reuses) the tool's own Developer Key and records it as a `PandaPal::LtiRegistration` on the Organization. The Organization's `key` keeps pointing at the default tool. On LTI 1.0 both tools share the Organization's consumer key and secret.
+- **Install hooks:** `before_lti_install` / `after_lti_install` callbacks can read `current_lti_install` (`tool`, `host`, `context`, `version`, `exists`, `dedicated_deployment`, and, in `after_lti_install`, the resulting Canvas `installation`). That lets you install a second tool alongside the default one:
+  ```ruby
+  # app/models/organization_extension.rb
+  included do
+    after_lti_install :install_translate_tool
+  end
+
+  def install_translate_tool
+    install = current_lti_install
+    return unless install.tool == PandaPal::DEFAULT_TOOL # the nested :translate install runs these callbacks too
+    install_lti(**install.to_h.except(:installation), tool: :translate)
+  end
+  ```
 - **Launches:** `current_session.lti_tool` says which tool was launched. On LTI 1.3 the tool comes from the registration matching the launch's client ID (and deployment ID). On LTI 1.0 it comes from the signed `custom_panda_pal_tool` field that every non-default tool config includes. PandaPal routes each launch, and each deep-link redirect, using that tool's placements.
 - **Registering by hand:** if a tool's Developer Key was set up outside `install_lti`, register it yourself: `org.lti_registrations.create!(tool: 'translate', client_id: '10000000000123', deployment_id: nil)`. A registration with a `deployment_id` takes priority over one without.
 

data/app/models/panda_pal/platform/canvas.rb

@@ -62,10 +62,21 @@ module PandaPal
     module OrgExtension
       extend ActiveSupport::Concern
 
+      # What an install_lti call is installing, for :lti_install callbacks to read
+      # through #current_lti_install. `version` is normalized ('v1p0'/'v1p3').
+      # `installation` is the Canvas external tool, set once the install has run
+      # (so it's there for after_lti_install, not before_lti_install).
+      LtiInstall = Struct.new(:tool, :host, :context, :version, :exists, :dedicated_deployment, :installation, keyword_init: true)
+
       included do
         define_model_callbacks :lti_install
       end
 
+      # The LtiInstall currently running callbacks, or nil outside install_lti.
+      # An install started from inside a callback gets its own LtiInstall, and the
+      # outer one comes back once it's done.
+      attr_reader :current_lti_install
+
       def _parse_lti_context(context)
         context = context.to_s
         context = 'account/self' if context == 'root_account'
@@ -79,6 +90,7 @@ module PandaPal
       # instead of the default one. In LTI 1.3 each tool is its own Developer Key,
       # tracked by an LtiRegistration rather than by this Organization's `key`.
       def _install_lti(host: nil, context: :root_account, version: nil, exists: :error, dedicated_deployment: false, tool: PandaPal::DEFAULT_TOOL)
+        outer_install = @current_lti_install
         raise "Automatically installing this LTI requires Bearcat." unless defined?(Bearcat)
 
         tool = PandaPal.normalize_lti_tool!(tool)
@@ -95,6 +107,15 @@ module PandaPal
 
         # TODO Ensure host is actually this LTI
 
+        @current_lti_install = LtiInstall.new(
+          tool: tool,
+          host: host,
+          context: context,
+          version: version,
+          exists: exists,
+          dedicated_deployment: dedicated_deployment,
+        )
+
         run_callbacks :lti_install do
           ctype, cid = _parse_lti_context(context)
 
@@ -155,9 +176,13 @@ module PandaPal
           else
             raise "Unrecognized LTI Version #{version}"
           end
+
+          @current_lti_install.installation = @new_lti_installation
         end
 
         save!
+      ensure
+        @current_lti_install = outer_install
       end
 
       def install_lti(*args, **kwargs)

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.19.0.beta1'
+  VERSION = '5.19.0.beta2'
 end

data/panda_pal.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |s|
   s.license     = "MIT"
 
   s.files = Dir["{app,config,db,lib}/**/*", "MIT-LICENSE", "Rakefile", "README.md", "AGS.md", "panda_pal.gemspec"]
-  s.test_files = Dir["spec/**/*"].reject{|f| f =~ /\/log\//}
+  # s.test_files = Dir["spec/**/*"].reject{|f| f =~ /\/log\//}
 
   s.add_dependency "rails", ">= 4.2"
   s.add_dependency 'ros-apartment', '~> 3.0'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.19.0.beta1
+  version: 5.19.0.beta2
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -216,35 +216,6 @@ files:
 - lib/panda_pal/version.rb
 - lib/tasks/panda_pal_tasks.rake
 - panda_pal.gemspec
-- spec/controllers/panda_pal/api_call_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_tools_spec.rb
-- spec/core/apartment_multidb_spec.rb
-- spec/factories/panda_pal_organizations.rb
-- spec/factories/panda_pal_sessions.rb
-- spec/internal/app/models/account.rb
-- spec/internal/app/models/admin.rb
-- spec/internal/config/database.yml
-- spec/internal/config/routes.rb
-- spec/internal/config/storage.yml
-- spec/internal/db/schema.rb
-- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
-- spec/lib/panda_pal/ags_client_spec.rb
-- spec/lib/panda_pal/helpers/secure_headers_spec.rb
-- spec/lib/panda_pal/helpers/session_replacement_spec.rb
-- spec/lib/panda_pal/lti_tools_spec.rb
-- spec/models/panda_pal/api_call_spec.rb
-- spec/models/panda_pal/lti_registration_spec.rb
-- spec/models/panda_pal/organization/settings_validation_spec.rb
-- spec/models/panda_pal/organization/task_scheduling_spec.rb
-- spec/models/panda_pal/organization_spec.rb
-- spec/models/panda_pal/platform/canvas_install_spec.rb
-- spec/models/panda_pal/platform_spec.rb
-- spec/models/panda_pal/session_account_roles_spec.rb
-- spec/models/panda_pal/session_spec.rb
-- spec/spec_helper.rb
-- spec/support/isolated_lti_config.rb
 homepage: http://instructure.com
 licenses:
 - MIT
@@ -266,33 +237,4 @@ requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
 summary: LTI mountable engine
-test_files:
-- spec/controllers/panda_pal/api_call_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_tools_spec.rb
-- spec/core/apartment_multidb_spec.rb
-- spec/factories/panda_pal_organizations.rb
-- spec/factories/panda_pal_sessions.rb
-- spec/internal/app/models/account.rb
-- spec/internal/app/models/admin.rb
-- spec/internal/config/database.yml
-- spec/internal/config/routes.rb
-- spec/internal/config/storage.yml
-- spec/internal/db/schema.rb
-- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
-- spec/lib/panda_pal/ags_client_spec.rb
-- spec/lib/panda_pal/helpers/secure_headers_spec.rb
-- spec/lib/panda_pal/helpers/session_replacement_spec.rb
-- spec/lib/panda_pal/lti_tools_spec.rb
-- spec/models/panda_pal/api_call_spec.rb
-- spec/models/panda_pal/lti_registration_spec.rb
-- spec/models/panda_pal/organization/settings_validation_spec.rb
-- spec/models/panda_pal/organization/task_scheduling_spec.rb
-- spec/models/panda_pal/organization_spec.rb
-- spec/models/panda_pal/platform/canvas_install_spec.rb
-- spec/models/panda_pal/platform_spec.rb
-- spec/models/panda_pal/session_account_roles_spec.rb
-- spec/models/panda_pal/session_spec.rb
-- spec/spec_helper.rb
-- spec/support/isolated_lti_config.rb
+test_files: []

data/spec/controllers/panda_pal/api_call_controller_spec.rb

@@ -1,25 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe PandaPal::ApiCallController, type: :controller do
-  let!(:api_call) { PandaPal::ApiCall.create!(logic: '"#{p[:foo]}_bar"') }
-
-  def json_body
-    JSON.parse(response.body)
-  end
-
-  describe "#call" do
-    it "calls the function with parameters" do
-      get :call, params: { token: api_call.jwt_token, foo: 'bar', use_route: 'panda_pal' }
-      expect(response).to be_successful
-      expect(json_body["status"]).to eq 'ok'
-      expect(json_body["result"]).to eq 'bar_bar'
-    end
-
-    it "fails given a bad JWT" do
-      get :call, params: { token: "bad.jwt.token", foo: 'bar', use_route: 'panda_pal' }
-      expect(response).not_to be_successful
-      expect(json_body["status"]).to eq 'error'
-      expect(json_body["error"]).to eq 'Invalid JWT'
-    end
-  end
-end

data/spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb

@@ -1,194 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe "PandaPal::LtiV1P0Controller", type: :request do
-  let(:organization) { create(:panda_pal_organization) }
-  let(:launch_url) { panda_pal.v1p0_launch_url(host: 'www.example.com') }
-
-  # Signs a full LTI v1p0 launch params hash the same way an LMS (Tool Consumer)
-  # would, using the platform-side half of the very same `ims-lti` gem that
-  # PandaPal uses on the tool-provider side to validate incoming launches.
-  def signed_launch_params(secret:, timestamp: Time.now.to_i, launch_type: 'panda_pal', custom: {})
-    consumer = IMS::LTI::ToolConsumer.new(organization.key, secret, {
-      'resource_link_id' => 'test-resource-link-id',
-    })
-    consumer.launch_url = launch_url
-    consumer.timestamp = timestamp
-    # `launch_type` isn't a spec'd LTI param, but the controller reads it from
-    # params, so it must be included in the signed payload or the signature
-    # PandaPal recomputes on the real request body won't match.
-    consumer.set_non_spec_param('launch_type', launch_type)
-    custom.each { |k, v| consumer.set_custom_param(k.to_s, v) }
-    consumer.generate_launch_data
-  end
-
-  def launched_session
-    organization.switch_tenant { PandaPal::Session.order(:id).last }
-  end
-
-  after do
-    # `validate_v1p0_launch` permanently switches the Apartment tenant to the
-    # organization's schema on a successful launch (PandaPal::Organization
-    # #switch_tenant with no block => Apartment::Tenant.switch!). Reset it so
-    # this doesn't leak into other spec files run later in the suite.
-    Apartment::Tenant.reset
-  end
-
-  describe 'POST /v1p0/launch' do
-    context 'with a validly-signed launch' do
-      it 'passes signature validation, starts a session, and redirects instead of rendering the 401 body' do
-        params = signed_launch_params(secret: organization.secret)
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).not_to have_http_status(:unauthorized)
-        expect(response.body).not_to include('Failed to validate LTI v1p0 launch')
-        expect(response).to have_http_status(:found)
-        expect(response.headers['Location']).to include('/panda_pal')
-
-        # The session record is created after PandaPal switches Apartment tenants
-        # to the organization's own schema, so look it up there.
-        session_count = organization.switch_tenant { PandaPal::Session.count }
-        expect(session_count).to eq(1)
-      end
-    end
-
-    context 'tools', :isolated_lti_config do
-      before do
-        # Only the translate tool routes editor_button anywhere real (the mount
-        # point) - the default tool would fall back to a missing editor_button_url.
-        PandaPal.stage_placement(:editor_button, tool: :translate, url: :panda_pal)
-      end
-
-      it 'records the default tool for a launch with no tool custom field' do
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: signed_launch_params(secret: organization.secret)
-
-        expect(response).to have_http_status(:found)
-        expect(launched_session.lti_tool).to eq(PandaPal::DEFAULT_TOOL)
-      end
-
-      it "routes by the signed tool custom field and records the tool on the session" do
-        params = signed_launch_params(secret: organization.secret, launch_type: 'editor_button', custom: { PandaPal::TOOL_CUSTOM_FIELD => 'translate' })
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:found)
-        expect(response.headers['Location']).to include('/panda_pal')
-        expect(launched_session.lti_tool).to eq(:translate)
-      end
-
-      it 'rejects a launch naming a tool that was never defined' do
-        params = signed_launch_params(secret: organization.secret, custom: { PandaPal::TOOL_CUSTOM_FIELD => 'nope' })
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Unrecognized LTI tool')
-      end
-    end
-
-    context 'with an invalid signature (wrong secret used to sign)' do
-      it 'renders 401 with the failure body' do
-        params = signed_launch_params(secret: 'not-the-real-secret')
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-
-    context 'with a tampered parameter after signing' do
-      it 'renders 401 with the failure body' do
-        params = signed_launch_params(secret: organization.secret)
-        params['resource_link_id'] = 'a-different-resource-link-id'
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-
-    context 'with a stale oauth_timestamp' do
-      it 'renders 401 without ever consulting IMS::LTI::ToolProvider' do
-        stale_timestamp = 400.seconds.ago.to_i
-        params = signed_launch_params(secret: organization.secret, timestamp: stale_timestamp)
-
-        expect(IMS::LTI::ToolProvider).not_to receive(:new)
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-  end
-
-  describe 'safari_override (browser gem regression coverage)' do
-    let(:safari_user_agent) do
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
-    end
-    let(:chrome_user_agent) do
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
-    end
-
-    # safari_override is the very first thing validate_launch! does, before any
-    # OAuth/org checks, so an otherwise-invalid launch is sufficient to exercise it.
-    it 'applies the secure_headers safari override when the User-Agent is Safari' do
-      expect_any_instance_of(PandaPal::LtiV1P0Controller).to receive(:use_secure_headers_override).with(:safari_override)
-
-      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => safari_user_agent }
-    end
-
-    it 'does not apply the override for a non-Safari User-Agent (Chrome)' do
-      expect_any_instance_of(PandaPal::LtiV1P0Controller).not_to receive(:use_secure_headers_override)
-
-      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => chrome_user_agent }
-    end
-  end
-
-  describe 'GET /v1p0/config', :isolated_lti_config do
-    before do
-      PandaPal.lti_environments = { domain: 'tool.example.com' }
-      PandaPal.lti_options = { title: 'Shared Title' }
-      PandaPal.stage_placement(:course_navigation, url: :panda_pal, text: 'Settings')
-      PandaPal.define_tool(:translate, title: 'Translate Title')
-      PandaPal.stage_placement(:editor_button, tool: :translate, url: :panda_pal, text: 'Translate')
-    end
-
-    def ext_param(doc, name)
-      doc.at_xpath("//lticm:property[@name='#{name}'] | //lticm:options[@name='#{name}']", 'lticm' => 'http://www.imsglobal.org/xsd/imslticm_v1p0')
-    end
-
-    it "serves only the default tool's placements without a tool param" do
-      get '/panda_pal/v1p0/config'
-
-      doc = Nokogiri::XML(response.body)
-      expect(response).to have_http_status(:ok)
-      expect(doc.at_xpath('//blti:title', 'blti' => 'http://www.imsglobal.org/xsd/imsbasiclti_v1p0').text).to eq('Shared Title')
-      expect(ext_param(doc, 'course_navigation')).to be_present
-      expect(ext_param(doc, 'editor_button')).to be_nil
-      expect(response.body).not_to include(PandaPal::TOOL_CUSTOM_FIELD)
-    end
-
-    it "serves the requested tool's title, placements, and tool custom field" do
-      get '/panda_pal/v1p0/config', params: { tool: 'translate' }
-
-      doc = Nokogiri::XML(response.body)
-      expect(response).to have_http_status(:ok)
-      expect(doc.at_xpath('//blti:title', 'blti' => 'http://www.imsglobal.org/xsd/imsbasiclti_v1p0').text).to eq('Translate Title')
-      expect(ext_param(doc, 'editor_button')).to be_present
-      expect(ext_param(doc, 'course_navigation')).to be_nil
-
-      custom = doc.at_xpath("//blti:custom/lticm:property[@name='#{PandaPal::TOOL_CUSTOM_FIELD}']",
-        'blti' => 'http://www.imsglobal.org/xsd/imsbasiclti_v1p0', 'lticm' => 'http://www.imsglobal.org/xsd/imslticm_v1p0')
-      expect(custom&.text).to eq('translate')
-    end
-
-    it 'renders 404 for an unknown tool' do
-      get '/panda_pal/v1p0/config', params: { tool: 'nope' }
-
-      expect(response).to have_http_status(:not_found)
-    end
-  end
-end

data/spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb

@@ -1,108 +0,0 @@
-require 'spec_helper'
-require 'nokogiri'
-
-RSpec.describe "PandaPal::LtiV1P3Controller", type: :request do
-  describe 'GET /v1p3/public_jwks' do
-    let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
-    let(:test_jwk) { JWT::JWK.new(rsa_key, { use: 'sig', alg: 'RS256' }) }
-
-    before { PandaPal.jwk = test_jwk }
-
-    after do
-      # PandaPal.jwk memoizes into a class variable (`@@jwk ||= ...`). Reset it
-      # so our test key doesn't leak into other spec files run later in the suite.
-      PandaPal.jwk = nil
-    end
-
-    it 'renders a 200 JSON JWK Set whose key matches PandaPal.jwk, with no private key material' do
-      get "/panda_pal/v1p3/public_jwks"
-
-      expect(response).to have_http_status(:ok)
-
-      expected_body = JSON.parse(JWT::JWK::Set.new(test_jwk).export.to_json)
-      body = JSON.parse(response.body)
-
-      expect(body).to eq(expected_body)
-      expect(body['keys']).to be_an(Array)
-      expect(body['keys'].length).to eq(1)
-
-      returned_key = body['keys'].first
-      expect(returned_key['kty']).to eq('RSA')
-      expect(returned_key['use']).to eq('sig')
-      expect(returned_key['alg']).to eq('RS256')
-      expect(returned_key['n']).to eq(test_jwk[:n])
-      expect(returned_key['e']).to eq(test_jwk[:e])
-      # Only the public modulus/exponent should ever be exposed - never private key material.
-      expect(returned_key.keys).not_to include('d', 'p', 'q', 'dp', 'dq', 'qi')
-    end
-  end
-
-  describe 'GET /v1p3/oidc_login' do
-    let(:login_params) do
-      {
-        client_id: 'test-client-id',
-        login_hint: 'test-login-hint',
-        lti_message_hint: 'test-lti-message-hint',
-        iss: 'https://canvas.instructure.com',
-      }
-    end
-
-    it 'renders the auto-submit form targeting the platform auth redirect URL, with the expected hidden fields' do
-      get "/panda_pal/v1p3/oidc_login", params: login_params
-
-      expect(response).to have_http_status(:ok)
-
-      doc = Nokogiri::HTML(response.body)
-      form = doc.at_css('form#redirect-form')
-      expect(form).not_to be_nil
-
-      created_session = PandaPal::Session.order(:id).last
-      expect(created_session).not_to be_nil
-
-      expect(form['action']).to eq(PandaPal::Platform::Canvas.new(iss: 'https://canvas.instructure.com').authentication_redirect_url)
-
-      hidden_fields = form.css('input[type=hidden]').each_with_object({}) do |input, h|
-        h[input['name']] = input['value']
-      end
-
-      expect(hidden_fields['client_id']).to eq('test-client-id')
-      expect(hidden_fields['login_hint']).to eq('test-login-hint')
-      expect(hidden_fields['lti_message_hint']).to eq('test-lti-message-hint')
-      expect(hidden_fields['scope']).to eq('openid')
-      expect(hidden_fields['response_type']).to eq('id_token')
-      expect(hidden_fields['state']).to eq(created_session.session_key)
-      expect(hidden_fields['nonce']).to eq(created_session[:lti_oauth_nonce])
-      expect(hidden_fields['nonce']).not_to be_blank
-    end
-  end
-
-  describe 'GET /v1p3/config' do
-    before { PandaPal.lti_environments = { domain: 'tool.example.com' } }
-
-    after do
-      PandaPal.lti_environments = {}
-      PandaPal.lti_scopes = []
-    end
-
-    it 'publishes no scopes by default' do
-      get "/panda_pal/v1p3/config"
-
-      expect(response).to have_http_status(:ok)
-      expect(JSON.parse(response.body)['scopes']).to eq([])
-    end
-
-    it 'publishes the configured PandaPal.lti_scopes' do
-      PandaPal.lti_scopes = [
-        PandaPal::LtiConstants::AgsScopes::SCORE,
-        PandaPal::LtiConstants::AgsScopes::LINEITEM_READONLY,
-      ]
-
-      get "/panda_pal/v1p3/config"
-
-      expect(JSON.parse(response.body)['scopes']).to eq([
-        'https://purl.imsglobal.org/spec/lti-ags/scope/score',
-        'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem.readonly',
-      ])
-    end
-  end
-end

data/spec/controllers/panda_pal/lti_v1_p3_tools_spec.rb

@@ -1,144 +0,0 @@
-require 'spec_helper'
-require 'json/jwt'
-
-RSpec.describe "PandaPal::LtiV1P3Controller tools", type: :request, isolated_lti_config: true do
-  let(:organization) { create(:panda_pal_organization, key: '10000000000001') }
-  let(:issuer) { 'https://canvas.instructure.com' }
-  let(:platform_key) { OpenSSL::PKey::RSA.new(2048) }
-  let(:platform_jwk) { JSON::JWK.new(platform_key.public_key) }
-
-  before do
-    PandaPal.lti_environments = { domain: 'tool.example.com' }
-    PandaPal.lti_options = { title: 'Shared Title' }
-    PandaPal.stage_placement(:course_navigation, text: 'Settings')
-    PandaPal.define_tool(:translate, title: 'Translate Title')
-    # Only the translate tool routes editor_button anywhere real (the mount
-    # point) - the default tool would fall back to a missing editor_button_url.
-    PandaPal.stage_placement(:editor_button, tool: :translate, url: :panda_pal, text: 'Translate')
-  end
-
-  after { Apartment::Tenant.reset }
-
-  describe 'GET /v1p3/config' do
-    it "serves only the default tool's placements without a tool param" do
-      get '/panda_pal/v1p3/config'
-
-      body = JSON.parse(response.body)
-      placements = body.dig('extensions', 0, 'settings', 'placements').map { |p| p['placement'] }
-
-      expect(body['title']).to eq('Shared Title')
-      expect(placements).to eq(['course_navigation'])
-      expect(body['custom_fields']).not_to have_key(PandaPal::TOOL_CUSTOM_FIELD)
-    end
-
-    it "serves the requested tool's title, placements, and tool custom field" do
-      get '/panda_pal/v1p3/config', params: { tool: 'translate' }
-
-      body = JSON.parse(response.body)
-      placements = body.dig('extensions', 0, 'settings', 'placements')
-
-      expect(body['title']).to eq('Translate Title')
-      expect(placements.map { |p| p['placement'] }).to eq(['editor_button'])
-      expect(placements[0]['target_link_uri']).to include('/panda_pal/v1p3/resource_link_request?launch_type=editor_button')
-      expect(body['custom_fields'][PandaPal::TOOL_CUSTOM_FIELD]).to eq('translate')
-    end
-
-    it 'renders 404 for an unknown tool' do
-      get '/panda_pal/v1p3/config', params: { tool: 'nope' }
-
-      expect(response).to have_http_status(:not_found)
-    end
-  end
-
-  describe 'POST /v1p3/resource_link_request' do
-    let(:nonce) { SecureRandom.uuid }
-
-    let!(:login_session) do
-      # What LtiV1P3Controller#login leaves behind in the public schema.
-      PandaPal::Session.create!(panda_pal_organization_id: 0, data: {
-        lti_platform: PandaPal::Platform::Canvas.new(iss: issuer).serialize,
-        lti_oauth_nonce: nonce,
-      })
-    end
-
-    before do
-      allow_any_instance_of(PandaPal::Platform::Canvas).to receive(:public_jwks).and_return(JSON::JWK::Set.new(platform_jwk))
-      # Launch validation records nonces in Rails.cache - keep them in memory
-      # rather than in the dummy app's file store.
-      allow(Rails).to receive(:cache).and_return(ActiveSupport::Cache::MemoryStore.new)
-    end
-
-    def id_token(client_id:, deployment_id: 'dep-1', placement: 'editor_button')
-      claims = {
-        iss: issuer,
-        aud: client_id,
-        sub: 'user-1',
-        nonce: nonce,
-        iat: Time.now.to_i,
-        exp: Time.now.to_i + 300,
-        PandaPal::LtiConstants::Claims::DEPLOYMENT_ID => deployment_id,
-        PandaPal::LtiConstants::Claims::MESSAGE_TYPE => 'LtiResourceLinkRequest',
-        PandaPal::LtiConstants::Canvas::PLACEMENT => placement,
-      }
-      jwt = JSON::JWT.new(claims)
-      jwt.kid = platform_jwk[:kid]
-      jwt.sign(platform_key, :RS256).to_s
-    end
-
-    def launch!(**token_opts)
-      post '/panda_pal/v1p3/resource_link_request', params: { id_token: id_token(**token_opts), state: login_session.session_key }
-    end
-
-    def launched_session
-      organization.switch_tenant { PandaPal::Session.order(:id).last }
-    end
-
-    it "resolves a registered tool's client_id to its organization and routes by that tool" do
-      organization.lti_registrations.create!(tool: 'translate', client_id: '10000000000002')
-
-      launch!(client_id: '10000000000002')
-
-      expect(response).to have_http_status(:found)
-      expect(response.headers['Location']).to include('/panda_pal')
-      expect(launched_session.lti_tool).to eq(:translate)
-      expect(launched_session.panda_pal_organization).to eq(organization)
-    end
-
-    it 'prefers a deployment-specific registration' do
-      other_org = create(:panda_pal_organization)
-      other_org.lti_registrations.create!(tool: 'translate', client_id: '10000000000002')
-      organization.lti_registrations.create!(tool: 'translate', client_id: '10000000000002', deployment_id: 'dep-1')
-
-      launch!(client_id: '10000000000002', deployment_id: 'dep-1')
-
-      expect(response).to have_http_status(:found)
-      expect(launched_session.panda_pal_organization).to eq(organization)
-    end
-
-    it "still resolves the organization's own key as the default tool" do
-      PandaPal.stage_placement(:course_navigation, url: :panda_pal)
-
-      launch!(client_id: organization.key, placement: 'course_navigation')
-
-      expect(response).to have_http_status(:found)
-      expect(launched_session.lti_tool).to eq(PandaPal::DEFAULT_TOOL)
-    end
-
-    it 'rejects a registration whose tool is no longer defined' do
-      registration = organization.lti_registrations.create!(tool: 'translate', client_id: '10000000000002')
-      registration.update_column(:tool, 'removed')
-
-      launch!(client_id: '10000000000002')
-
-      expect(response).to have_http_status(:unauthorized)
-      expect(response.body).to include('Unrecognized LTI tool')
-    end
-
-    it 'rejects an unregistered client_id' do
-      launch!(client_id: '99999')
-
-      expect(response).to have_http_status(:unauthorized)
-      expect(response.body).to include('Unrecognized Organization')
-    end
-  end
-end