panda_pal 5.19.0.beta1 → 5.19.0.beta3

data/spec/controllers/panda_pal/lti_v1_p3_tools_spec.rb

@@ -1,144 +0,0 @@
-require 'spec_helper'
-require 'json/jwt'
-
-RSpec.describe "PandaPal::LtiV1P3Controller tools", type: :request, isolated_lti_config: true do
-  let(:organization) { create(:panda_pal_organization, key: '10000000000001') }
-  let(:issuer) { 'https://canvas.instructure.com' }
-  let(:platform_key) { OpenSSL::PKey::RSA.new(2048) }
-  let(:platform_jwk) { JSON::JWK.new(platform_key.public_key) }
-
-  before do
-    PandaPal.lti_environments = { domain: 'tool.example.com' }
-    PandaPal.lti_options = { title: 'Shared Title' }
-    PandaPal.stage_placement(:course_navigation, text: 'Settings')
-    PandaPal.define_tool(:translate, title: 'Translate Title')
-    # Only the translate tool routes editor_button anywhere real (the mount
-    # point) - the default tool would fall back to a missing editor_button_url.
-    PandaPal.stage_placement(:editor_button, tool: :translate, url: :panda_pal, text: 'Translate')
-  end
-
-  after { Apartment::Tenant.reset }
-
-  describe 'GET /v1p3/config' do
-    it "serves only the default tool's placements without a tool param" do
-      get '/panda_pal/v1p3/config'
-
-      body = JSON.parse(response.body)
-      placements = body.dig('extensions', 0, 'settings', 'placements').map { |p| p['placement'] }
-
-      expect(body['title']).to eq('Shared Title')
-      expect(placements).to eq(['course_navigation'])
-      expect(body['custom_fields']).not_to have_key(PandaPal::TOOL_CUSTOM_FIELD)
-    end
-
-    it "serves the requested tool's title, placements, and tool custom field" do
-      get '/panda_pal/v1p3/config', params: { tool: 'translate' }
-
-      body = JSON.parse(response.body)
-      placements = body.dig('extensions', 0, 'settings', 'placements')
-
-      expect(body['title']).to eq('Translate Title')
-      expect(placements.map { |p| p['placement'] }).to eq(['editor_button'])
-      expect(placements[0]['target_link_uri']).to include('/panda_pal/v1p3/resource_link_request?launch_type=editor_button')
-      expect(body['custom_fields'][PandaPal::TOOL_CUSTOM_FIELD]).to eq('translate')
-    end
-
-    it 'renders 404 for an unknown tool' do
-      get '/panda_pal/v1p3/config', params: { tool: 'nope' }
-
-      expect(response).to have_http_status(:not_found)
-    end
-  end
-
-  describe 'POST /v1p3/resource_link_request' do
-    let(:nonce) { SecureRandom.uuid }
-
-    let!(:login_session) do
-      # What LtiV1P3Controller#login leaves behind in the public schema.
-      PandaPal::Session.create!(panda_pal_organization_id: 0, data: {
-        lti_platform: PandaPal::Platform::Canvas.new(iss: issuer).serialize,
-        lti_oauth_nonce: nonce,
-      })
-    end
-
-    before do
-      allow_any_instance_of(PandaPal::Platform::Canvas).to receive(:public_jwks).and_return(JSON::JWK::Set.new(platform_jwk))
-      # Launch validation records nonces in Rails.cache - keep them in memory
-      # rather than in the dummy app's file store.
-      allow(Rails).to receive(:cache).and_return(ActiveSupport::Cache::MemoryStore.new)
-    end
-
-    def id_token(client_id:, deployment_id: 'dep-1', placement: 'editor_button')
-      claims = {
-        iss: issuer,
-        aud: client_id,
-        sub: 'user-1',
-        nonce: nonce,
-        iat: Time.now.to_i,
-        exp: Time.now.to_i + 300,
-        PandaPal::LtiConstants::Claims::DEPLOYMENT_ID => deployment_id,
-        PandaPal::LtiConstants::Claims::MESSAGE_TYPE => 'LtiResourceLinkRequest',
-        PandaPal::LtiConstants::Canvas::PLACEMENT => placement,
-      }
-      jwt = JSON::JWT.new(claims)
-      jwt.kid = platform_jwk[:kid]
-      jwt.sign(platform_key, :RS256).to_s
-    end
-
-    def launch!(**token_opts)
-      post '/panda_pal/v1p3/resource_link_request', params: { id_token: id_token(**token_opts), state: login_session.session_key }
-    end
-
-    def launched_session
-      organization.switch_tenant { PandaPal::Session.order(:id).last }
-    end
-
-    it "resolves a registered tool's client_id to its organization and routes by that tool" do
-      organization.lti_registrations.create!(tool: 'translate', client_id: '10000000000002')
-
-      launch!(client_id: '10000000000002')
-
-      expect(response).to have_http_status(:found)
-      expect(response.headers['Location']).to include('/panda_pal')
-      expect(launched_session.lti_tool).to eq(:translate)
-      expect(launched_session.panda_pal_organization).to eq(organization)
-    end
-
-    it 'prefers a deployment-specific registration' do
-      other_org = create(:panda_pal_organization)
-      other_org.lti_registrations.create!(tool: 'translate', client_id: '10000000000002')
-      organization.lti_registrations.create!(tool: 'translate', client_id: '10000000000002', deployment_id: 'dep-1')
-
-      launch!(client_id: '10000000000002', deployment_id: 'dep-1')
-
-      expect(response).to have_http_status(:found)
-      expect(launched_session.panda_pal_organization).to eq(organization)
-    end
-
-    it "still resolves the organization's own key as the default tool" do
-      PandaPal.stage_placement(:course_navigation, url: :panda_pal)
-
-      launch!(client_id: organization.key, placement: 'course_navigation')
-
-      expect(response).to have_http_status(:found)
-      expect(launched_session.lti_tool).to eq(PandaPal::DEFAULT_TOOL)
-    end
-
-    it 'rejects a registration whose tool is no longer defined' do
-      registration = organization.lti_registrations.create!(tool: 'translate', client_id: '10000000000002')
-      registration.update_column(:tool, 'removed')
-
-      launch!(client_id: '10000000000002')
-
-      expect(response).to have_http_status(:unauthorized)
-      expect(response.body).to include('Unrecognized LTI tool')
-    end
-
-    it 'rejects an unregistered client_id' do
-      launch!(client_id: '99999')
-
-      expect(response).to have_http_status(:unauthorized)
-      expect(response.body).to include('Unrecognized Organization')
-    end
-  end
-end

data/spec/core/apartment_multidb_spec.rb

@@ -1,166 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe PandaPal::Organization, type: :model do
-  context "across multiple DBs" do
-    with_multiple_shards(
-      shards: { alt: "panda_pal_test2" },
-      tenant_names: %w[on_primary alt:on_alt],
-      transactional: false,
-      determine_shard: ->(org) { org.name.include?("alt") ? "alt" : nil }
-    )
-
-    let!(:org1) { create(:panda_pal_organization, name: "on_primary") }
-    let!(:org2) { create(:panda_pal_organization, name: "on_alt") }
-
-    it "successfully creates tenants on multiple shards" do
-      expect(1).to eql(1)
-    end
-
-    it "only creates schemas on the target shard" do
-      org1.switch_tenant do
-        schemas = PandaPal::ApiCall.connection.exec_query("SELECT schema_name FROM information_schema.schemata").pluck("schema_name")
-        expect(schemas).to include("on_primary")
-        expect(schemas).to_not include("on_alt")
-      end
-      org2.switch_tenant do
-        schemas = PandaPal::ApiCall.connection.exec_query("SELECT schema_name FROM information_schema.schemata").pluck("schema_name")
-        expect(schemas).to include("on_alt")
-        expect(schemas).to_not include("on_primary")
-      end
-    end
-
-    it "creates records on the target shard and schema" do
-      org1.switch_tenant
-      PandaPal::ApiCall.create!(logic: "from_primary")
-      expect(PandaPal::ApiCall.count).to eq(1)
-      expect(PandaPal::ApiCall.first.logic).to eq("from_primary")
-
-      org2.switch_tenant
-      PandaPal::ApiCall.create!(logic: "from_alt")
-      expect(PandaPal::ApiCall.count).to eq(1)
-      expect(PandaPal::ApiCall.first.logic).to eq("from_alt")
-
-      org1.switch_tenant
-      expect(PandaPal::ApiCall.count).to eq(1)
-      expect(PandaPal::ApiCall.first.logic).to eq("from_primary")
-      expect(PandaPal::ApiCall.connection.exec_query("SELECT current_database()").pluck("current_database")[0]).to eq("panda_pal_test1")
-
-      org2.switch_tenant
-      expect(PandaPal::ApiCall.count).to eq(1)
-      expect(PandaPal::ApiCall.first.logic).to eq("from_alt")
-      expect(PandaPal::ApiCall.connection.exec_query("SELECT current_database()").pluck("current_database")[0]).to eq("panda_pal_test2")
-    end
-
-    context "connection pool lifecycle" do
-      def alt_pool
-        ActiveRecord::Base.connection_handler.retrieve_connection_pool(
-          ActiveRecord::Base.connection_specification_name,
-          role: ActiveRecord::Base.current_role,
-          shard: "apt:alt",
-        )
-      end
-
-      def count_establish_connection_calls
-        calls = Queue.new
-        allow(Apartment).to receive(:establish_connection).and_wrap_original do |original, *args, **kwargs|
-          calls << true
-          original.call(*args, **kwargs)
-        end
-        yield
-        calls.size
-      end
-
-      def switch_in_threads(tenant, count)
-        start = Queue.new
-        threads = count.times.map do
-          Thread.new do
-            start.pop
-            Apartment::Tenant.switch(tenant) { PandaPal::ApiCall.count }
-          ensure
-            ActiveRecord::Base.connection_handler.clear_active_connections!
-          end
-        end
-        count.times { start << true }
-        threads.map(&:value)
-      end
-
-      it "reuses an existing shard pool whose connections have all been closed" do
-        org2.switch_tenant { PandaPal::ApiCall.count }
-        pool = alt_pool
-        ActiveRecord::Base.connection_handler.clear_active_connections!
-        pool.disconnect!
-
-        calls = count_establish_connection_calls do
-          org2.switch_tenant { expect(PandaPal::ApiCall.count).to eq(0) }
-        end
-
-        expect(calls).to eq(0)
-        expect(alt_pool).to equal(pool)
-      end
-
-      it "establishes a missing shard pool once when many threads need it at the same time" do
-        org2.switch_tenant { PandaPal::ApiCall.count }
-        ActiveRecord::Base.connection_handler.clear_active_connections!
-        ActiveRecord::Base.connection_handler.remove_connection_pool(
-          ActiveRecord::Base.connection_specification_name,
-          role: ActiveRecord::Base.current_role,
-          shard: "apt:alt",
-        )
-
-        results = nil
-        calls = count_establish_connection_calls do
-          results = switch_in_threads("alt:on_alt", 8)
-        end
-
-        expect(results).to eq([0] * 8)
-        expect(calls).to eq(1)
-      end
-    end
-
-    # load_async is a Rails 7.0+ feature.
-    context "load_async", skip: (ActiveRecord::Relation.method_defined?(:load_async) ? false : "requires Rails 7.0+ load_async") do
-      it "works across shards" do
-        qs = []
-        PandaPal::Organization.all.each do |org|
-          org.switch_tenant do
-            PandaPal::ApiCall.create!(logic: org.name)
-            qs << PandaPal::ApiCall.select("logic, pg_sleep(0.5)").load_async
-          end
-        end
-        calls = qs.map(&:to_a).flatten
-        expect(calls.pluck(:logic)).to match_array(["on_primary", "on_alt"])
-      end
-    end
-  end
-
-  context "tenant switch error wrapping" do
-    around do |example|
-      original = Apartment.with_multi_server_setup
-      Apartment.configure { |c| c.with_multi_server_setup = true }
-      Apartment::Tenant.reload!
-      example.run
-    ensure
-      Apartment.configure { |c| c.with_multi_server_setup = original }
-      Apartment::Tenant.reload!
-    end
-
-    it "does not mask a connection pool timeout as Apartment::TenantNotFound (PFS-31252)" do
-      adapter = Apartment::Tenant.adapter
-      previous_tenant = adapter.current
-
-      allow(ActiveRecord::Base).to receive(:connection) do
-        # Un-stub before raising: ActiveRecord::Base.connection is inherited by
-        # ros-apartment's SeparateDbConnectionHandler (used for schema create/drop),
-        # so leaving the stub in place past this one intended failure would misroute
-        # unrelated connection lookups made elsewhere.
-        allow(ActiveRecord::Base).to receive(:connection).and_call_original
-        raise ActiveRecord::ConnectionTimeoutError, "could not obtain a connection from the pool within 5.000 seconds"
-      end
-
-      expect { adapter.connect_to_new("alt:some_org") }.to raise_error(ActiveRecord::ConnectionTimeoutError)
-      expect(adapter.current).to eq(previous_tenant)
-    end
-  end
-end

data/spec/factories/panda_pal_organizations.rb

@@ -1,9 +0,0 @@
-FactoryBot.define do
-  factory :panda_pal_organization, class: 'PandaPal::Organization' do
-    name { SecureRandom.hex }
-    key { SecureRandom.hex }
-    secret { SecureRandom.hex }
-    canvas_account_id { SecureRandom.random_number(10000) }
-    salesforce_id { SecureRandom.hex }
-  end
-end

data/spec/factories/panda_pal_sessions.rb

@@ -1,6 +0,0 @@
-FactoryBot.define do
-  factory :panda_pal_session, class: 'PandaPal::Session' do
-    panda_pal_organization { nil }
-    data { "MyText" }
-  end
-end

data/spec/internal/app/models/account.rb

@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-# Minimal stand-in for the CanvasSync-generated Account. Present so that
-# Session#canvas_account_ancestry exercises its local-mirror branch (the one
-# host apps actually hit) rather than the Canvas API fallback.
-class Account < ActiveRecord::Base
-end

data/spec/internal/app/models/admin.rb

@@ -1,6 +0,0 @@
-# frozen_string_literal: true
-
-# Minimal stand-in for the CanvasSync-generated Admin roster model that
-# Session#canvas_account_role_labels reads role labels from.
-class Admin < ActiveRecord::Base
-end

data/spec/internal/config/database.yml

@@ -1,18 +0,0 @@
-default: &default
-  database: panda-pal-test
-  adapter: postgresql
-  encoding: unicode
-  # For details on connection pooling, see Rails configuration guide
-  # http://guides.rubyonrails.org/configuring.html#database-pooling
-  pool: <%= ENV.fetch("DB_POOL_SIZE", nil) || (ENV.fetch("RAILS_MAX_THREADS") { 5 }.to_i + 10) %>
-  username: <%= ENV.fetch("DB_USERNAME", "") %>
-  password: <%= ENV.fetch("DB_PASSWORD", "") %>
-  host: <%= ENV.fetch("DB_ADDRESS", "localhost") %>
-
-test:
-  test1:
-    <<: *default
-    database: panda_pal_test1
-  test2:
-    <<: *default
-    database: panda_pal_test2

data/spec/internal/config/routes.rb

@@ -1,5 +0,0 @@
-# frozen_string_literal: true
-
-Rails.application.routes.draw do
-  mount PandaPal::Engine => "/panda_pal"
-end

data/spec/internal/config/storage.yml

@@ -1,3 +0,0 @@
-test:
-  service: Disk
-  root: /Users/eknapp/code/panda_pal/tmp/storage

data/spec/internal/db/schema.rb

@@ -1,30 +0,0 @@
-# frozen_string_literal: true
-
-ActiveRecord::Schema.define do
-  # Set up any tables you need to exist for your test suite that don't belong
-  # in migrations.
-
-  # Stand-ins for the CanvasSync-generated, tenant-scoped models that
-  # Session#canvas_account_role_labels duck-types on. Only the columns it
-  # actually reads are declared. `accounts` deliberately has NO `ancestry`
-  # column: that gem is optional in host apps, so the traversal has to work
-  # from `canvas_parent_account_id` alone.
-  create_table :accounts, force: true do |t|
-    t.bigint :canvas_id, null: false
-    t.bigint :canvas_parent_account_id
-    t.string :name
-    t.string :workflow_state, default: "active"
-    t.timestamps
-  end
-  add_index :accounts, :canvas_id, unique: true
-
-  create_table :admins, force: true do |t|
-    t.bigint :canvas_id
-    t.bigint :canvas_user_id, null: false
-    t.bigint :canvas_account_id, null: false
-    t.string :role_name
-    t.string :workflow_state, default: "active"
-    t.timestamps
-  end
-  add_index :admins, [ :canvas_user_id, :canvas_account_id ]
-end

data/spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb

@@ -1,83 +0,0 @@
-require 'spec_helper'
-
-module PandaPal::Jobs
-  RSpec.describe GradePassbackJob, type: :job do
-    let(:organization) { create(:panda_pal_organization) }
-    let(:job) { described_class.new }
-
-    describe '#perform' do
-      context 'with missing required params' do
-        it 'raises MissingGradePassbackParams when passback_guid is missing' do
-          expect(IMS::LTI::ToolProvider).not_to receive(:new)
-
-          expect {
-            job.perform(organization, { passback_url: 'http://example.com/passback', score: 0.9 })
-          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
-        end
-
-        it 'raises MissingGradePassbackParams when passback_url is missing' do
-          expect(IMS::LTI::ToolProvider).not_to receive(:new)
-
-          expect {
-            job.perform(organization, { passback_guid: 'guid-123', score: 0.9 })
-          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
-        end
-
-        it 'raises MissingGradePassbackParams when both score and total_score are missing' do
-          expect(IMS::LTI::ToolProvider).not_to receive(:new)
-
-          expect {
-            job.perform(organization, { passback_guid: 'guid-123', passback_url: 'http://example.com/passback' })
-          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
-        end
-
-        it 'raises MissingGradePassbackParams when opts is entirely empty' do
-          expect(IMS::LTI::ToolProvider).not_to receive(:new)
-
-          expect {
-            job.perform(organization, {})
-          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
-        end
-      end
-
-      context 'with valid options' do
-        let(:opts) { { passback_guid: 'guid-123', passback_url: 'http://example.com/passback', score: 0.9 } }
-        let(:tool_provider_double) { double('IMS::LTI::ToolProvider') }
-
-        before do
-          allow(IMS::LTI::ToolProvider).to receive(:new)
-            .with(organization.key, organization.secret, hash_including(
-              'lis_result_sourcedid' => opts[:passback_guid],
-              'lis_outcome_service_url' => opts[:passback_url]
-            ))
-            .and_return(tool_provider_double)
-        end
-
-        it 'posts to the LMS and does not raise when the response is successful' do
-          success_result = double('OutcomeResponse', success?: true)
-          expect(tool_provider_double).to receive(:post_extended_replace_result!).with(opts).and_return(success_result)
-
-          expect {
-            job.perform(organization, opts)
-          }.not_to raise_error
-        end
-
-        it 'raises GradePassbackFailure when the tool provider reports failure' do
-          failure_result = double(
-            'OutcomeResponse',
-            success?: false,
-            response_code: 500,
-            code_major: 'failure',
-            severity: 'error',
-            description: 'boom'
-          )
-          expect(tool_provider_double).to receive(:post_extended_replace_result!).with(opts).and_return(failure_result)
-
-          expect {
-            job.perform(organization, opts)
-          }.to raise_error(PandaPal::Jobs::GradePassbackFailure)
-        end
-      end
-    end
-  end
-end