panda_pal 5.19.0.beta1 → 5.19.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 36f3440bb369f482a622cca1b58dbe3857bd74749d53776be10e6b99e8bf3f79
-  data.tar.gz: 02c42332159e06ae1778d8155c2a58d230ae24dc82a5f1e0c6027aa7e0a9f274
+  metadata.gz: dc0521710ced7088a0342c4af3b5fc5e0435b3578aafe0ae1223ea98024e78ee
+  data.tar.gz: 48fb53a3d5522496fc93e8f74f4ceff4c3e510c5a8c74a2a16b4b5a83a7e1294
 SHA512:
-  metadata.gz: 9d4253dfec794377b88c5efbd6b2167b225373049e0e7b7694ef3f6f4d5e39253e71aa720094b39b336e6b4afc251b00c7f60f35dc1dbe3bb11dde35ce9b966b
-  data.tar.gz: b5004d4d2f7be4dcfb91d70d81445284084ea24a11f03f8db8513c6794cacdef99bf9c4da96c50b51cd1a9870ae4129ca3d66ac6b91a0065f4ef34e1aac59157
+  metadata.gz: eceb5025a2c539f4ca2c9d6a2757d34595cc8071a30d34b988310ee06cf5e8224d4b514b8cc73bb0f871f2c810d31070c09c4fa3b6d58d61d5f65344aef35d4e
+  data.tar.gz: 23402bf99ee96e7ecd37bda8750e5463cf12361c703d38112d464bfa8314ca666ff8bc66cfac3d59205cb3874e7d0613e076be0b55cbb4ecd36674ffda2d285c

data/README.md

@@ -56,6 +56,19 @@ lti_nav editor_button: 'translate#editor_button', tool: :translate # Served at <
 
 - **Config:** each tool has its own config URL: `/v1p3/config?tool=translate` and `/v1p0/config?tool=translate`. The default tool's URLs are unchanged.
 - **Install:** `org.install_lti(host: ..., tool: :translate)`. On LTI 1.3 this creates (or reuses) the tool's own Developer Key and records it as a `PandaPal::LtiRegistration` on the Organization. The Organization's `key` keeps pointing at the default tool. On LTI 1.0 both tools share the Organization's consumer key and secret.
+- **Install hooks:** `before_lti_install` / `after_lti_install` callbacks can read `current_lti_install` (`tool`, `host`, `context`, `version`, `exists`, `dedicated_deployment`, and, in `after_lti_install`, the resulting Canvas `installation`). That lets you install a second tool alongside the default one:
+  ```ruby
+  # app/models/organization_extension.rb
+  included do
+    after_lti_install :install_translate_tool
+  end
+
+  def install_translate_tool
+    install = current_lti_install
+    return unless install.tool == PandaPal::DEFAULT_TOOL # the nested :translate install runs these callbacks too
+    install_lti(**install.to_h.except(:installation), tool: :translate)
+  end
+  ```
 - **Launches:** `current_session.lti_tool` says which tool was launched. On LTI 1.3 the tool comes from the registration matching the launch's client ID (and deployment ID). On LTI 1.0 it comes from the signed `custom_panda_pal_tool` field that every non-default tool config includes. PandaPal routes each launch, and each deep-link redirect, using that tool's placements.
 - **Registering by hand:** if a tool's Developer Key was set up outside `install_lti`, register it yourself: `org.lti_registrations.create!(tool: 'translate', client_id: '10000000000123', deployment_id: nil)`. A registration with a `deployment_id` takes priority over one without.
 

data/app/models/panda_pal/platform/canvas.rb

@@ -62,10 +62,21 @@ module PandaPal
     module OrgExtension
       extend ActiveSupport::Concern
 
+      # What an install_lti call is installing, for :lti_install callbacks to read
+      # through #current_lti_install. `version` is normalized ('v1p0'/'v1p3').
+      # `installation` is the Canvas external tool, set once the install has run
+      # (so it's there for after_lti_install, not before_lti_install).
+      LtiInstall = Struct.new(:tool, :host, :context, :version, :exists, :dedicated_deployment, :installation, keyword_init: true)
+
       included do
         define_model_callbacks :lti_install
       end
 
+      # The LtiInstall currently running callbacks, or nil outside install_lti.
+      # An install started from inside a callback gets its own LtiInstall, and the
+      # outer one comes back once it's done.
+      attr_reader :current_lti_install
+
       def _parse_lti_context(context)
         context = context.to_s
         context = 'account/self' if context == 'root_account'
@@ -79,6 +90,7 @@ module PandaPal
       # instead of the default one. In LTI 1.3 each tool is its own Developer Key,
       # tracked by an LtiRegistration rather than by this Organization's `key`.
       def _install_lti(host: nil, context: :root_account, version: nil, exists: :error, dedicated_deployment: false, tool: PandaPal::DEFAULT_TOOL)
+        outer_install = @current_lti_install
         raise "Automatically installing this LTI requires Bearcat." unless defined?(Bearcat)
 
         tool = PandaPal.normalize_lti_tool!(tool)
@@ -95,6 +107,15 @@ module PandaPal
 
         # TODO Ensure host is actually this LTI
 
+        @current_lti_install = LtiInstall.new(
+          tool: tool,
+          host: host,
+          context: context,
+          version: version,
+          exists: exists,
+          dedicated_deployment: dedicated_deployment,
+        )
+
         run_callbacks :lti_install do
           ctype, cid = _parse_lti_context(context)
 
@@ -127,37 +148,29 @@ module PandaPal
             scope_tool = existing_installs[0]
 
             # Don't need to do an update if it already exists - Settings are stored on the LTI Key instead of the installation
-            if tool != PandaPal::DEFAULT_TOOL
-              scope_tool ||= bearcat_client.send(:"create_#{ctype}_external_tool", cid, {
-                client_id: ekey[:id],
-              })
-
-              lti_registrations.find_or_create_by!(
-                tool: tool.to_s,
-                client_id: ekey[:id].to_s,
-                deployment_id: (scope_tool[:deployment_id].presence&.to_s if dedicated_deployment),
-              )
-            elsif !scope_tool
-              scope_tool = bearcat_client.send(:"create_#{ctype}_external_tool", cid, {
+            new_install = !scope_tool
+            scope_tool ||= _with_lti_registration_unlocked(ekey) do
+              bearcat_client.send(:"create_#{ctype}_external_tool", cid, {
                 client_id: ekey[:id],
               })
+            end
 
-              new_client_id = "#{ekey[:id]}"
-              new_client_id += "/#{scope_tool[:deployment_id]}" if dedicated_deployment
-
-              self.key = new_client_id
-              self.secret = ekey[:api_key]
-
-              save! if changed?
+            # The default tool's key only moves with a new install; other tools always (re)register
+            if new_install || tool != PandaPal::DEFAULT_TOOL
+              _register_lti_v1p3_key(tool, ekey, deployment_id: (scope_tool[:deployment_id].presence&.to_s if dedicated_deployment))
             end
 
             @new_lti_installation = scope_tool
           else
             raise "Unrecognized LTI Version #{version}"
           end
+
+          @current_lti_install.installation = @new_lti_installation
         end
 
         save!
+      ensure
+        @current_lti_install = outer_install
       end
 
       def install_lti(*args, **kwargs)
@@ -219,7 +232,8 @@ module PandaPal
 
         valid_redirect_uris.uniq!
 
-        if !ekey
+        created = !ekey
+        if created
           # Create New
           ekey = bearcat_client.post("api/lti/accounts/self/developer_keys/tool_configuration", {
             developer_key: {
@@ -245,6 +259,10 @@ module PandaPal
 
         ekey = ekey[:developer_key] || ekey
 
+        # Record a new key right away, so a failed install is retried against
+        # this key instead of creating yet another one.
+        _register_lti_v1p3_key(tool, ekey) if created
+
         if ekey[:developer_key_account_binding][:workflow_state] == "off"
           bearcat_client.post("api/v1/accounts/self/developer_keys/#{ekey[:id]}/developer_key_account_bindings", {
             developer_key_account_binding: {
@@ -256,6 +274,42 @@ module PandaPal
         ekey
       end
 
+      # Points this Organization (default tool) or an LtiRegistration (other
+      # tools) at a v1.3 Developer Key.
+      def _register_lti_v1p3_key(tool, ekey, deployment_id: nil)
+        client_id = ekey[:id].to_s
+
+        if tool == PandaPal::DEFAULT_TOOL
+          self.key = deployment_id ? "#{client_id}/#{deployment_id}" : client_id
+          self.secret = ekey[:api_key] if ekey[:api_key].present?
+          save! if changed?
+        else
+          lti_registrations.find_or_create_by!(tool: tool.to_s, client_id: client_id, deployment_id: deployment_id)
+          # Drop the deployment-less placeholder recorded when the key was created
+          lti_registrations.where(tool: tool.to_s, client_id: client_id, deployment_id: nil).delete_all if deployment_id
+        end
+      end
+
+      # Canvas creates LTI Registrations with lock_deploying on, which blocks
+      # installing by client_id (when lock_lti_registrations is enabled). Unlock
+      # for the duration of the block, then put the lock back as it was.
+      def _with_lti_registration_unlocked(ekey)
+        registration_id = ekey[:lti_registration_id]
+        return yield unless registration_id.present?
+
+        registration_url = "api/v1/accounts/self/lti_registrations/#{registration_id}"
+        registration = bearcat_client.get(registration_url)
+        # Inherited registrations can only be changed by their owning account
+        return yield unless registration[:lock_deploying] && !registration[:inherited]
+
+        bearcat_client.put(registration_url, { lock_deploying: false })
+        begin
+          yield
+        ensure
+          bearcat_client.put(registration_url, { lock_deploying: true })
+        end
+      end
+
       def _find_existing_installs(context, exists: nil, &matcher)
         ctype, cid = _parse_lti_context(context)
 

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.19.0.beta1'
+  VERSION = '5.19.0.beta3'
 end

data/panda_pal.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |s|
   s.license     = "MIT"
 
   s.files = Dir["{app,config,db,lib}/**/*", "MIT-LICENSE", "Rakefile", "README.md", "AGS.md", "panda_pal.gemspec"]
-  s.test_files = Dir["spec/**/*"].reject{|f| f =~ /\/log\//}
+  # s.test_files = Dir["spec/**/*"].reject{|f| f =~ /\/log\//}
 
   s.add_dependency "rails", ">= 4.2"
   s.add_dependency 'ros-apartment', '~> 3.0'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.19.0.beta1
+  version: 5.19.0.beta3
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -216,35 +216,6 @@ files:
 - lib/panda_pal/version.rb
 - lib/tasks/panda_pal_tasks.rake
 - panda_pal.gemspec
-- spec/controllers/panda_pal/api_call_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_tools_spec.rb
-- spec/core/apartment_multidb_spec.rb
-- spec/factories/panda_pal_organizations.rb
-- spec/factories/panda_pal_sessions.rb
-- spec/internal/app/models/account.rb
-- spec/internal/app/models/admin.rb
-- spec/internal/config/database.yml
-- spec/internal/config/routes.rb
-- spec/internal/config/storage.yml
-- spec/internal/db/schema.rb
-- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
-- spec/lib/panda_pal/ags_client_spec.rb
-- spec/lib/panda_pal/helpers/secure_headers_spec.rb
-- spec/lib/panda_pal/helpers/session_replacement_spec.rb
-- spec/lib/panda_pal/lti_tools_spec.rb
-- spec/models/panda_pal/api_call_spec.rb
-- spec/models/panda_pal/lti_registration_spec.rb
-- spec/models/panda_pal/organization/settings_validation_spec.rb
-- spec/models/panda_pal/organization/task_scheduling_spec.rb
-- spec/models/panda_pal/organization_spec.rb
-- spec/models/panda_pal/platform/canvas_install_spec.rb
-- spec/models/panda_pal/platform_spec.rb
-- spec/models/panda_pal/session_account_roles_spec.rb
-- spec/models/panda_pal/session_spec.rb
-- spec/spec_helper.rb
-- spec/support/isolated_lti_config.rb
 homepage: http://instructure.com
 licenses:
 - MIT
@@ -266,33 +237,4 @@ requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
 summary: LTI mountable engine
-test_files:
-- spec/controllers/panda_pal/api_call_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
-- spec/controllers/panda_pal/lti_v1_p3_tools_spec.rb
-- spec/core/apartment_multidb_spec.rb
-- spec/factories/panda_pal_organizations.rb
-- spec/factories/panda_pal_sessions.rb
-- spec/internal/app/models/account.rb
-- spec/internal/app/models/admin.rb
-- spec/internal/config/database.yml
-- spec/internal/config/routes.rb
-- spec/internal/config/storage.yml
-- spec/internal/db/schema.rb
-- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
-- spec/lib/panda_pal/ags_client_spec.rb
-- spec/lib/panda_pal/helpers/secure_headers_spec.rb
-- spec/lib/panda_pal/helpers/session_replacement_spec.rb
-- spec/lib/panda_pal/lti_tools_spec.rb
-- spec/models/panda_pal/api_call_spec.rb
-- spec/models/panda_pal/lti_registration_spec.rb
-- spec/models/panda_pal/organization/settings_validation_spec.rb
-- spec/models/panda_pal/organization/task_scheduling_spec.rb
-- spec/models/panda_pal/organization_spec.rb
-- spec/models/panda_pal/platform/canvas_install_spec.rb
-- spec/models/panda_pal/platform_spec.rb
-- spec/models/panda_pal/session_account_roles_spec.rb
-- spec/models/panda_pal/session_spec.rb
-- spec/spec_helper.rb
-- spec/support/isolated_lti_config.rb
+test_files: []

data/spec/controllers/panda_pal/api_call_controller_spec.rb

@@ -1,25 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe PandaPal::ApiCallController, type: :controller do
-  let!(:api_call) { PandaPal::ApiCall.create!(logic: '"#{p[:foo]}_bar"') }
-
-  def json_body
-    JSON.parse(response.body)
-  end
-
-  describe "#call" do
-    it "calls the function with parameters" do
-      get :call, params: { token: api_call.jwt_token, foo: 'bar', use_route: 'panda_pal' }
-      expect(response).to be_successful
-      expect(json_body["status"]).to eq 'ok'
-      expect(json_body["result"]).to eq 'bar_bar'
-    end
-
-    it "fails given a bad JWT" do
-      get :call, params: { token: "bad.jwt.token", foo: 'bar', use_route: 'panda_pal' }
-      expect(response).not_to be_successful
-      expect(json_body["status"]).to eq 'error'
-      expect(json_body["error"]).to eq 'Invalid JWT'
-    end
-  end
-end

data/spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb

@@ -1,194 +0,0 @@
-require 'spec_helper'
-
-RSpec.describe "PandaPal::LtiV1P0Controller", type: :request do
-  let(:organization) { create(:panda_pal_organization) }
-  let(:launch_url) { panda_pal.v1p0_launch_url(host: 'www.example.com') }
-
-  # Signs a full LTI v1p0 launch params hash the same way an LMS (Tool Consumer)
-  # would, using the platform-side half of the very same `ims-lti` gem that
-  # PandaPal uses on the tool-provider side to validate incoming launches.
-  def signed_launch_params(secret:, timestamp: Time.now.to_i, launch_type: 'panda_pal', custom: {})
-    consumer = IMS::LTI::ToolConsumer.new(organization.key, secret, {
-      'resource_link_id' => 'test-resource-link-id',
-    })
-    consumer.launch_url = launch_url
-    consumer.timestamp = timestamp
-    # `launch_type` isn't a spec'd LTI param, but the controller reads it from
-    # params, so it must be included in the signed payload or the signature
-    # PandaPal recomputes on the real request body won't match.
-    consumer.set_non_spec_param('launch_type', launch_type)
-    custom.each { |k, v| consumer.set_custom_param(k.to_s, v) }
-    consumer.generate_launch_data
-  end
-
-  def launched_session
-    organization.switch_tenant { PandaPal::Session.order(:id).last }
-  end
-
-  after do
-    # `validate_v1p0_launch` permanently switches the Apartment tenant to the
-    # organization's schema on a successful launch (PandaPal::Organization
-    # #switch_tenant with no block => Apartment::Tenant.switch!). Reset it so
-    # this doesn't leak into other spec files run later in the suite.
-    Apartment::Tenant.reset
-  end
-
-  describe 'POST /v1p0/launch' do
-    context 'with a validly-signed launch' do
-      it 'passes signature validation, starts a session, and redirects instead of rendering the 401 body' do
-        params = signed_launch_params(secret: organization.secret)
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).not_to have_http_status(:unauthorized)
-        expect(response.body).not_to include('Failed to validate LTI v1p0 launch')
-        expect(response).to have_http_status(:found)
-        expect(response.headers['Location']).to include('/panda_pal')
-
-        # The session record is created after PandaPal switches Apartment tenants
-        # to the organization's own schema, so look it up there.
-        session_count = organization.switch_tenant { PandaPal::Session.count }
-        expect(session_count).to eq(1)
-      end
-    end
-
-    context 'tools', :isolated_lti_config do
-      before do
-        # Only the translate tool routes editor_button anywhere real (the mount
-        # point) - the default tool would fall back to a missing editor_button_url.
-        PandaPal.stage_placement(:editor_button, tool: :translate, url: :panda_pal)
-      end
-
-      it 'records the default tool for a launch with no tool custom field' do
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: signed_launch_params(secret: organization.secret)
-
-        expect(response).to have_http_status(:found)
-        expect(launched_session.lti_tool).to eq(PandaPal::DEFAULT_TOOL)
-      end
-
-      it "routes by the signed tool custom field and records the tool on the session" do
-        params = signed_launch_params(secret: organization.secret, launch_type: 'editor_button', custom: { PandaPal::TOOL_CUSTOM_FIELD => 'translate' })
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:found)
-        expect(response.headers['Location']).to include('/panda_pal')
-        expect(launched_session.lti_tool).to eq(:translate)
-      end
-
-      it 'rejects a launch naming a tool that was never defined' do
-        params = signed_launch_params(secret: organization.secret, custom: { PandaPal::TOOL_CUSTOM_FIELD => 'nope' })
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Unrecognized LTI tool')
-      end
-    end
-
-    context 'with an invalid signature (wrong secret used to sign)' do
-      it 'renders 401 with the failure body' do
-        params = signed_launch_params(secret: 'not-the-real-secret')
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-
-    context 'with a tampered parameter after signing' do
-      it 'renders 401 with the failure body' do
-        params = signed_launch_params(secret: organization.secret)
-        params['resource_link_id'] = 'a-different-resource-link-id'
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-
-    context 'with a stale oauth_timestamp' do
-      it 'renders 401 without ever consulting IMS::LTI::ToolProvider' do
-        stale_timestamp = 400.seconds.ago.to_i
-        params = signed_launch_params(secret: organization.secret, timestamp: stale_timestamp)
-
-        expect(IMS::LTI::ToolProvider).not_to receive(:new)
-
-        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
-
-        expect(response).to have_http_status(:unauthorized)
-        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
-      end
-    end
-  end
-
-  describe 'safari_override (browser gem regression coverage)' do
-    let(:safari_user_agent) do
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
-    end
-    let(:chrome_user_agent) do
-      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
-    end
-
-    # safari_override is the very first thing validate_launch! does, before any
-    # OAuth/org checks, so an otherwise-invalid launch is sufficient to exercise it.
-    it 'applies the secure_headers safari override when the User-Agent is Safari' do
-      expect_any_instance_of(PandaPal::LtiV1P0Controller).to receive(:use_secure_headers_override).with(:safari_override)
-
-      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => safari_user_agent }
-    end
-
-    it 'does not apply the override for a non-Safari User-Agent (Chrome)' do
-      expect_any_instance_of(PandaPal::LtiV1P0Controller).not_to receive(:use_secure_headers_override)
-
-      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => chrome_user_agent }
-    end
-  end
-
-  describe 'GET /v1p0/config', :isolated_lti_config do
-    before do
-      PandaPal.lti_environments = { domain: 'tool.example.com' }
-      PandaPal.lti_options = { title: 'Shared Title' }
-      PandaPal.stage_placement(:course_navigation, url: :panda_pal, text: 'Settings')
-      PandaPal.define_tool(:translate, title: 'Translate Title')
-      PandaPal.stage_placement(:editor_button, tool: :translate, url: :panda_pal, text: 'Translate')
-    end
-
-    def ext_param(doc, name)
-      doc.at_xpath("//lticm:property[@name='#{name}'] | //lticm:options[@name='#{name}']", 'lticm' => 'http://www.imsglobal.org/xsd/imslticm_v1p0')
-    end
-
-    it "serves only the default tool's placements without a tool param" do
-      get '/panda_pal/v1p0/config'
-
-      doc = Nokogiri::XML(response.body)
-      expect(response).to have_http_status(:ok)
-      expect(doc.at_xpath('//blti:title', 'blti' => 'http://www.imsglobal.org/xsd/imsbasiclti_v1p0').text).to eq('Shared Title')
-      expect(ext_param(doc, 'course_navigation')).to be_present
-      expect(ext_param(doc, 'editor_button')).to be_nil
-      expect(response.body).not_to include(PandaPal::TOOL_CUSTOM_FIELD)
-    end
-
-    it "serves the requested tool's title, placements, and tool custom field" do
-      get '/panda_pal/v1p0/config', params: { tool: 'translate' }
-
-      doc = Nokogiri::XML(response.body)
-      expect(response).to have_http_status(:ok)
-      expect(doc.at_xpath('//blti:title', 'blti' => 'http://www.imsglobal.org/xsd/imsbasiclti_v1p0').text).to eq('Translate Title')
-      expect(ext_param(doc, 'editor_button')).to be_present
-      expect(ext_param(doc, 'course_navigation')).to be_nil
-
-      custom = doc.at_xpath("//blti:custom/lticm:property[@name='#{PandaPal::TOOL_CUSTOM_FIELD}']",
-        'blti' => 'http://www.imsglobal.org/xsd/imsbasiclti_v1p0', 'lticm' => 'http://www.imsglobal.org/xsd/imslticm_v1p0')
-      expect(custom&.text).to eq('translate')
-    end
-
-    it 'renders 404 for an unknown tool' do
-      get '/panda_pal/v1p0/config', params: { tool: 'nope' }
-
-      expect(response).to have_http_status(:not_found)
-    end
-  end
-end

data/spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb

@@ -1,108 +0,0 @@
-require 'spec_helper'
-require 'nokogiri'
-
-RSpec.describe "PandaPal::LtiV1P3Controller", type: :request do
-  describe 'GET /v1p3/public_jwks' do
-    let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
-    let(:test_jwk) { JWT::JWK.new(rsa_key, { use: 'sig', alg: 'RS256' }) }
-
-    before { PandaPal.jwk = test_jwk }
-
-    after do
-      # PandaPal.jwk memoizes into a class variable (`@@jwk ||= ...`). Reset it
-      # so our test key doesn't leak into other spec files run later in the suite.
-      PandaPal.jwk = nil
-    end
-
-    it 'renders a 200 JSON JWK Set whose key matches PandaPal.jwk, with no private key material' do
-      get "/panda_pal/v1p3/public_jwks"
-
-      expect(response).to have_http_status(:ok)
-
-      expected_body = JSON.parse(JWT::JWK::Set.new(test_jwk).export.to_json)
-      body = JSON.parse(response.body)
-
-      expect(body).to eq(expected_body)
-      expect(body['keys']).to be_an(Array)
-      expect(body['keys'].length).to eq(1)
-
-      returned_key = body['keys'].first
-      expect(returned_key['kty']).to eq('RSA')
-      expect(returned_key['use']).to eq('sig')
-      expect(returned_key['alg']).to eq('RS256')
-      expect(returned_key['n']).to eq(test_jwk[:n])
-      expect(returned_key['e']).to eq(test_jwk[:e])
-      # Only the public modulus/exponent should ever be exposed - never private key material.
-      expect(returned_key.keys).not_to include('d', 'p', 'q', 'dp', 'dq', 'qi')
-    end
-  end
-
-  describe 'GET /v1p3/oidc_login' do
-    let(:login_params) do
-      {
-        client_id: 'test-client-id',
-        login_hint: 'test-login-hint',
-        lti_message_hint: 'test-lti-message-hint',
-        iss: 'https://canvas.instructure.com',
-      }
-    end
-
-    it 'renders the auto-submit form targeting the platform auth redirect URL, with the expected hidden fields' do
-      get "/panda_pal/v1p3/oidc_login", params: login_params
-
-      expect(response).to have_http_status(:ok)
-
-      doc = Nokogiri::HTML(response.body)
-      form = doc.at_css('form#redirect-form')
-      expect(form).not_to be_nil
-
-      created_session = PandaPal::Session.order(:id).last
-      expect(created_session).not_to be_nil
-
-      expect(form['action']).to eq(PandaPal::Platform::Canvas.new(iss: 'https://canvas.instructure.com').authentication_redirect_url)
-
-      hidden_fields = form.css('input[type=hidden]').each_with_object({}) do |input, h|
-        h[input['name']] = input['value']
-      end
-
-      expect(hidden_fields['client_id']).to eq('test-client-id')
-      expect(hidden_fields['login_hint']).to eq('test-login-hint')
-      expect(hidden_fields['lti_message_hint']).to eq('test-lti-message-hint')
-      expect(hidden_fields['scope']).to eq('openid')
-      expect(hidden_fields['response_type']).to eq('id_token')
-      expect(hidden_fields['state']).to eq(created_session.session_key)
-      expect(hidden_fields['nonce']).to eq(created_session[:lti_oauth_nonce])
-      expect(hidden_fields['nonce']).not_to be_blank
-    end
-  end
-
-  describe 'GET /v1p3/config' do
-    before { PandaPal.lti_environments = { domain: 'tool.example.com' } }
-
-    after do
-      PandaPal.lti_environments = {}
-      PandaPal.lti_scopes = []
-    end
-
-    it 'publishes no scopes by default' do
-      get "/panda_pal/v1p3/config"
-
-      expect(response).to have_http_status(:ok)
-      expect(JSON.parse(response.body)['scopes']).to eq([])
-    end
-
-    it 'publishes the configured PandaPal.lti_scopes' do
-      PandaPal.lti_scopes = [
-        PandaPal::LtiConstants::AgsScopes::SCORE,
-        PandaPal::LtiConstants::AgsScopes::LINEITEM_READONLY,
-      ]
-
-      get "/panda_pal/v1p3/config"
-
-      expect(JSON.parse(response.body)['scopes']).to eq([
-        'https://purl.imsglobal.org/spec/lti-ags/scope/score',
-        'https://purl.imsglobal.org/spec/lti-ags/scope/lineitem.readonly',
-      ])
-    end
-  end
-end