panda_pal 5.2.4 → 5.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1172960b6e10f42eb328a83126a990d94d897e5b53587ad2a9fbcf2ddbcef46e
-  data.tar.gz: 3ca6cc0d6f3e621741bf3891d858b6f8917618d31270f83aca8b0dcdd6c0ffa8
+  metadata.gz: 751203d046fbd547e8f194feabb335a81a08be96f6a557712f1673d139576a29
+  data.tar.gz: b06b642432ce0d1e4a42a4bc93520b3782c6d8cce801e91508b296be60501482
 SHA512:
-  metadata.gz: 746e87df1af33d9391a8b7ea2d90e244c720d86100dd033a68e2b5e21a6a3d0ac057d58c44acd178e5585751d1f6e11ff006df5da10ebb910eec7712e57e1cdb
-  data.tar.gz: b20a4ac6fc5b389c8dfd6df682d7c3c67c8fec4551bfc0fb2ada48dd2f2ac8a0806673a5a9e926bf9af961291a476978fb7bee4da32cc0f8915313c033ebd73f
+  metadata.gz: cc338a137cec8f7abb900b801ace89f1588b265d534babf98f6bb940307289b8a3175a9ce0d5d70a5ddeb520f3525d13e1ba0f7e52df34e75c6fda40ca03a3de
+  data.tar.gz: 717e7355ae2cfb990f40c589df6c29c138f55d660fa0095367a275e000a7041e98e99ec631f6dd1bf9e9f3068c7a01006d4a3580ac017cb358a18b9c9711a87f

data/README.md

@@ -369,8 +369,30 @@ You will want to watch out for a few scenarios:
 3) If you use `link_to` and navigate in your LTI (apps that are not single page)
    make sure you include the `link_nonce` like so: 
     ```ruby
-      link_to "Link Name", somewhere_else_path(session_token: link_nonce)
+      link_to "Link Name", somewhere_else_path(arg, session_token: link_nonce)
     ```
+    NB: As of PandaPal 5.2.6, you can instead use
+    ```ruby
+      link_to "Name", url_with_session(:somewhere_else_path, arg, kwarg: 1)
+    ```
+
+Persistent sessions have session_tokens as a way to safely communicate a session key in a way that is hopefully not too persistent in case it is logged somewhere.
+Options for communicating session_token -
+:nonce (default) - each nonce is good for exactly one communication with the backend server.  Once the nonce is used, it is no longer valid.
+:fixed_ip - each session_token is good until it expires.  It must be used from the same ip the LTI launched from.
+:expiring - this is the least secure.  Each token is good until it expires.
+
+For :fixed_ip and :expiring tokens you can override the default expiration period of 15 minutes.
+
+See the following example of how to override the link_nonce_type and token expiration length.
+
+class ApplicationController < ActionController::Base
+  link_nonce_type :fixed_ip
+  def session_expiration_period_minutes
+    120
+  end
+...
+end
 
 ### Previous Safari Instructions
 Safari is weird and you'll potentially run into issues getting `POST` requests to properly validate CSRF if you don't do the following:

data/app/controllers/panda_pal/lti_v1_p3_controller.rb

@@ -2,8 +2,6 @@ require_dependency "panda_pal/application_controller"
 
 module PandaPal
   class LtiV1P3Controller < ApplicationController
-    skip_before_action :verify_authenticity_token
-
     before_action :validate_launch!, only: [:resource_link_request]
     around_action :switch_tenant, only: [:resource_link_request]
 
@@ -37,6 +35,12 @@ module PandaPal
 
         redirect_with_session_to(:"#{LaunchUrlHelpers.launch_route(params[:launch_type])}_url", route_context: main_app)
       end
+      # render json: {
+      #   launch_type: params[:launch_type],
+      #   final_url: LaunchUrlHelpers.launch_url(params[:launch_type]),
+      #   final_route: LaunchUrlHelpers.launch_route(params[:launch_type]),
+      #   decoded_jwt: @decoded_lti_jwt,
+      # }
     end
 
     def tool_config

data/app/lib/panda_pal/misc_helper.rb

@@ -4,9 +4,9 @@ module PandaPal
 
     def self.to_boolean(v)
       if Rails.version < '5.0'
-        ActiveRecord::Type::Boolean.new.type_cast_from_user("0")
+        ActiveRecord::Type::Boolean.new.type_cast_from_user(v)
       else
-        ActiveRecord::Type::Boolean.new.deserialize('0')
+        ActiveRecord::Type::Boolean.new.deserialize(v)
       end
     end
   end

data/config/initializers/apartment.rb

@@ -1,7 +1,8 @@
 require 'apartment/elevators/generic'
 
 Apartment.configure do |config|
-  config.excluded_models = ['PandaPal::Organization', 'PandaPal::Session']
+  config.excluded_models ||= []
+  config.excluded_models |= ['PandaPal::Organization', 'PandaPal::Session']
 
   config.tenant_names = lambda {
     PandaPal::Organization.pluck(:name)
@@ -14,6 +15,21 @@ Rails.application.config.middleware.use Apartment::Elevators::Generic, lambda {
   end
 }
 
+module PandaPal::Plugins::ApartmentCache
+  private
+
+  if Rails.version >= '5.0'
+    def normalize_key(key, options)
+      "tenant:#{Apartment::Tenant.current}/#{super}"
+    end
+  else
+    def namespaced_key(*args)
+      "tenant:#{Apartment::Tenant.current}/#{super}"
+    end
+  end
+end
+ActiveSupport::Cache::Store.send(:prepend, PandaPal::Plugins::ApartmentCache)
+
 if defined?(ActionCable)
   module ActionCable
     module Channel
@@ -38,7 +54,7 @@ if defined?(ActionCable)
     end
   end
 
-  module ActionCableApartment
+  module PandaPal::Plugins::ActionCableApartment
     module Connection
       def tenant=(name)
         @tenant = name
@@ -56,18 +72,50 @@ if defined?(ActionCable)
     end
   end
 
-  ActionCable::Connection::Base.prepend(ActionCableApartment::Connection)
+  ActionCable::Connection::Base.prepend(PandaPal::Plugins::ActionCableApartment::Connection)
 end
 
-module ApartmentCache
-  private
+if defined?(Delayed)
+  module PandaPal::Plugins
+    class ApartmentDelayedJobsPlugin < ::Delayed::Plugin
+      callbacks do |lifecycle|
+        lifecycle.around(:enqueue) do |job, *args, &block|
+          current_tenant = Apartment::Tenant.current
 
-  def normalize_key(key, options)
-    "tenant:#{Apartment::Tenant.current}/#{super}"
-  end
+          #make sure enqueue on public tenant unless we are testing since delayed job is set to run immediately
+          Apartment::Tenant.switch!('public') unless Rails.env.test?
+          job.tenant = current_tenant
+          begin
+            block.call(job, *args)
+          rescue Exception => e
+            Rails.logger.error("Error enqueing job #{job.to_s} - #{e.backtrace}")
+          ensure
+            #switch back to prev tenant
+            Apartment::Tenant.switch!(current_tenant)
+          end
+        end
+
+        lifecycle.before(:perform) do |worker, *args, &block|
+          tenant = args.first.tenant
+          Apartment::Tenant.switch!(tenant) if tenant.present?
+          Rails.logger.debug("Running job with tenant #{Apartment::Tenant.current}")
+        end
+
+        lifecycle.around(:invoke_job) do |job, *args, &block|
+          begin
+            block.call(job, *args)
+          ensure
+            Apartment::Tenant.switch!('public')
+            Rails.logger.debug("Resetting Tenant back to: #{Apartment::Tenant.current}")
+          end
+        end
 
-  def namespaced_key(*args)
-    normalize_key(*args)
+        lifecycle.after(:failure) do |job, *args|
+          Rails.logger.error("Job failed on tenant: #{Apartment::Tenant.current}")
+        end
+      end
+    end
   end
+
+  Delayed::Worker.plugins << PandaPal::Plugins::ApartmentDelayedJobsPlugin
 end
-ActiveSupport::Cache::Store.send :prepend, ApartmentCache

data/lib/panda_pal/helpers/controller_helper.rb

@@ -1,226 +1,139 @@
 require 'browser'
+require_relative 'session_replacement'
 
-module PandaPal::Helpers::ControllerHelper
-  extend ActiveSupport::Concern
+module PandaPal::Helpers
+  module ControllerHelper
+    extend ActiveSupport::Concern
+    include SessionReplacement
 
-  class SessionNonceMismatch < StandardError; end
-
-  included do
-    helper_method :link_nonce, :current_session
-
-    after_action :auto_save_session
-  end
-
-  def save_session
-    current_session.try(:save)
-  end
-
-  def current_session
-    return @current_session if @current_session.present?
-
-    if params[:session_token]
-      payload = JSON.parse(panda_pal_cryptor.decrypt_and_verify(params[:session_token])).with_indifferent_access
-      matched_session = PandaPal::Session.find_by(session_key: payload[:session_key])
+    def current_organization
+      @organization ||= PandaPal::Organization.find_by!(key: organization_key) if organization_key
+      @organization ||= PandaPal::Organization.find_by(id: organization_id) if organization_id
+      @organization ||= PandaPal::Organization.find_by_name(Apartment::Tenant.current)
+    end
 
-      if matched_session.present? && matched_session.data[:link_nonce] == payload[:nonce]
-        @current_session = matched_session
-        @current_session.data[:link_nonce] = nil
+    def current_lti_platform
+      return @current_lti_platform if @current_lti_platform.present?
+      # TODO: (Future) This could be expanded more to take better advantage of the LTI 1.3 Multi-Tenancy model.
+      if (canvas_url = current_organization&.settings&.dig(:canvas, :base_url)).present?
+        @current_lti_platform ||= PandaPal::Platform::Canvas.new(canvas_url)
       end
-      raise SessionNonceMismatch, "Session Not Found" unless @current_session.present?
-    elsif (session_key = params[:session_key] || session_key_header || flash[:session_key] || session[:session_key]).present?
-      @current_session = PandaPal::Session.find_by(session_key: session_key) if session_key.present?
+      @current_lti_platform ||= PandaPal::Platform::Canvas.new('http://localhost:3000') if Rails.env.development?
+      @current_lti_platform ||= PandaPal::Platform::CANVAS
+      @current_lti_platform
     end
 
-    @current_session ||= PandaPal::Session.new(panda_pal_organization_id: current_organization.id)
-
-    @current_session
-  end
-
-  def current_organization
-    @organization ||= PandaPal::Organization.find_by!(key: organization_key) if organization_key
-    @organization ||= PandaPal::Organization.find_by(id: organization_id) if organization_id
-    @organization ||= PandaPal::Organization.find_by_name(Apartment::Tenant.current)
-  end
-
-  def current_lti_platform
-    return @current_lti_platform if @current_lti_platform.present?
-    # TODO: (Future) This could be expanded more to take better advantage of the LTI 1.3 Multi-Tenancy model.
-    if (canvas_url = current_organization&.settings&.dig(:canvas, :base_url)).present?
-      @current_lti_platform ||= PandaPal::Platform::Canvas.new(canvas_url)
+    def lti_launch_params
+      current_session_data[:launch_params]
     end
-    @current_lti_platform ||= PandaPal::Platform::Canvas.new('http://localhost:3000') if Rails.env.development?
-    @current_lti_platform ||= PandaPal::Platform::CANVAS
-    @current_lti_platform
-  end
-
-  def current_session_data
-    current_session.data
-  end
-
-  def lti_launch_params
-    current_session_data[:launch_params]
-  end
-
-  def session_changed?
-    current_session.changed? && current_session.changes[:data].present?
-  end
 
-  def validate_launch!
-    safari_override
+    def validate_launch!
+      safari_override
 
-    if params[:id_token].present?
-      validate_v1p3_launch
-    elsif params[:oauth_consumer_key].present?
-      validate_v1p0_launch
-    end
-  end
-
-  def validate_v1p0_launch
-    authorized = false
-    if @organization = params['oauth_consumer_key'] && PandaPal::Organization.find_by_key(params['oauth_consumer_key'])
-      sanitized_params = request.request_parameters
-      # These params come over with a safari-workaround launch.  The authenticator doesn't like them, so clean them out.
-      safe_unexpected_params = ["full_win_launch_requested", "platform_redirect_url", "dummy_param"]
-      safe_unexpected_params.each do |p|
-        sanitized_params.delete(p)
+      if params[:id_token].present?
+        validate_v1p3_launch
+      elsif params[:oauth_consumer_key].present?
+        validate_v1p0_launch
       end
-      authenticator = IMS::LTI::Services::MessageAuthenticator.new(request.original_url, sanitized_params, @organization.secret)
-      authorized = authenticator.valid_signature?
     end
 
-    if !authorized
-      render plain: 'Invalid Credentials, please contact your Administrator.', :status => :unauthorized unless authorized
-    end
-
-    authorized
-  end
+    def validate_v1p0_launch
+      authorized = false
+      if @organization = params['oauth_consumer_key'] && PandaPal::Organization.find_by_key(params['oauth_consumer_key'])
+        sanitized_params = request.request_parameters
+        # These params come over with a safari-workaround launch.  The authenticator doesn't like them, so clean them out.
+        safe_unexpected_params = ["full_win_launch_requested", "platform_redirect_url", "dummy_param"]
+        safe_unexpected_params.each do |p|
+          sanitized_params.delete(p)
+        end
+        authenticator = IMS::LTI::Services::MessageAuthenticator.new(request.original_url, sanitized_params, @organization.secret)
+        authorized = authenticator.valid_signature?
+      end
 
-  def validate_v1p3_launch
-    decoded_jwt = JSON::JWT.decode(params.require(:id_token), :skip_verification)
-    raise JSON::JWT::VerificationFailed, 'error decoding id_token' if decoded_jwt.blank?
+      if !authorized
+        render plain: 'Invalid Credentials, please contact your Administrator.', :status => :unauthorized unless authorized
+      end
 
-    client_id = decoded_jwt['aud']
-    @organization = PandaPal::Organization.find_by!(key: 'PandaPal') # client_id)
-    raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present?
+      authorized
+    end
 
-    decoded_jwt.verify!(current_lti_platform.public_jwks)
+    def validate_v1p3_launch
+      decoded_jwt = JSON::JWT.decode(params.require(:id_token), :skip_verification)
+      raise JSON::JWT::VerificationFailed, 'error decoding id_token' if decoded_jwt.blank?
 
-    params[:session_key] = params[:state]
-    raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_session_data[:lti_oauth_nonce] == decoded_jwt['nonce']
+      client_id = decoded_jwt['aud']
+      @organization = PandaPal::Organization.find_by!(key: client_id)
+      raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present?
 
-    jwt_verifier = PandaPal::LtiJwtValidator.new(decoded_jwt, client_id)
-    raise JSON::JWT::VerificationFailed, jwt_verifier.errors unless jwt_verifier.valid?
+      decoded_jwt.verify!(current_lti_platform.public_jwks)
 
-    @decoded_lti_jwt = decoded_jwt
-  rescue JSON::JWT::VerificationFailed => e
-    payload = Array(e.message)
+      params[:session_key] = params[:state]
+      raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_session_data[:lti_oauth_nonce] == decoded_jwt['nonce']
 
-    render json: {
-      message: [
-        { errors: payload },
-        { id_token: params.require(:id_token) },
-      ],
-    }, status: :unauthorized
+      jwt_verifier = PandaPal::LtiJwtValidator.new(decoded_jwt, client_id)
+      raise JSON::JWT::VerificationFailed, jwt_verifier.errors unless jwt_verifier.valid?
 
-    false
-  end
+      @decoded_lti_jwt = decoded_jwt
+    rescue JSON::JWT::VerificationFailed => e
+      payload = Array(e.message)
 
-  def switch_tenant(organization = current_organization, &block)
-    return unless organization
-    raise 'This method should be called in an around_action callback' unless block_given?
+      render json: {
+        message: [
+          { errors: payload },
+          { id_token: params.require(:id_token) },
+        ],
+      }, status: :unauthorized
 
-    Apartment::Tenant.switch(organization.name) do
-      yield
+      false
     end
-  end
 
-  def forbid_access_if_lacking_session
-    render plain: 'You should do an LTI Tool Launch.', status: :unauthorized unless valid_session?
-    safari_override
-  end
+    def switch_tenant(organization = current_organization, &block)
+      return unless organization
+      raise 'This method should be called in an around_action callback' unless block_given?
 
-  def verify_authenticity_token
-    # No need to check CSRF when no cookies were sent. This fixes CSRF failures in Browsers
-    # that restrict Cookie setting within an IFrame.
-    return unless request.cookies.keys.length > 0
-    super
-  end
-
-  def valid_session?
-    [
-      current_session.persisted?,
-      current_organization,
-      current_session.panda_pal_organization_id == current_organization.id,
-      Apartment::Tenant.current == current_organization.name
-    ].all?
-  rescue SessionNonceMismatch
-    false
-  end
-
-  def safari_override
-    use_secure_headers_override(:safari_override) if browser.safari?
-  end
-
-  # Redirect with the session key intact. In production,
-  # handle this by adding a one-time use encrypted token to the URL.
-  # Keeping it in the URL in development means that it plays
-  # nicely with webpack-dev-server live reloading (otherwise
-  # you get an access error everytime it tries to live reload).
-
-  def redirect_with_session_to(location, params = {}, route_context: self, **rest)
-    params.merge!(rest)
-    if Rails.env.development?
-      redirect_to route_context.send(location, {
-        session_key: current_session.session_key,
-        organization_id: current_organization.id,
-      }.merge(params))
-    else
-      redirect_to route_context.send(location, {
-        session_token: link_nonce,
-        organization_id: current_organization.id,
-      }.merge(params))
+      Apartment::Tenant.switch(organization.name) do
+        yield
+      end
     end
-  end
-
-  def link_nonce
-    @link_nonce ||= begin
-      current_session_data[:link_nonce] = SecureRandom.hex
 
-      payload = {
-        session_key: current_session.session_key,
-        organization_id: current_organization.id,
-        nonce: current_session_data[:link_nonce],
-      }
+    def forbid_access_if_lacking_session
+      super
+      safari_override
+    end
 
-      panda_pal_cryptor.encrypt_and_sign(payload.to_json)
+    def valid_session?
+      return false unless current_session(create_missing: false)&.persisted?
+      return false unless current_organization
+      return false unless current_session.panda_pal_organization_id == current_organization.id
+      return false unless Apartment::Tenant.current == current_organization.name
+      true
+    rescue SessionNonceMismatch
+      false
     end
-  end
 
-  private
+    def safari_override
+      use_secure_headers_override(:safari_override) if browser.safari?
+    end
 
-  def organization_key
-    org_key ||= params[:oauth_consumer_key]
-    org_key ||= "#{params[:client_id]}/#{params[:deployment_id]}" if params[:client_id].present?
-    org_key ||= session[:organization_key]
-    org_key
-  end
+    private
 
-  def organization_id
-    params[:organization_id]
-  end
-
-  def session_key_header
-    if match = request.headers['Authorization'].try(:match, /token=(.+)/)
-      match[1]
+    def find_or_create_session(key:)
+      if key == :create
+        PandaPal::Session.new(panda_pal_organization_id: current_organization.id)
+      else
+        PandaPal::Session.find_by(session_key: key)
+      end
     end
-  end
 
-  def panda_pal_cryptor
-    @panda_pal_cryptor ||= ActiveSupport::MessageEncryptor.new(Rails.application.secret_key_base[0..31])
-  end
+    def organization_key
+      org_key ||= params[:oauth_consumer_key]
+      org_key ||= "#{params[:client_id]}/#{params[:deployment_id]}" if params[:client_id].present?
+      org_key ||= session[:organization_key]
+      org_key
+    end
 
-  def auto_save_session
-    yield if block_given?
-    save_session if @current_session && session_changed?
+    def organization_id
+      params[:organization_id]
+    end
   end
 end

data/lib/panda_pal/helpers/session_replacement.rb

@@ -0,0 +1,192 @@
+module PandaPal::Helpers
+  class SessionNonceMismatch < StandardError; end
+
+  module SessionReplacement
+    extend ActiveSupport::Concern
+
+    included do
+      helper_method :link_nonce, :current_session, :current_session_data
+      helper_method :link_with_session_to, :url_with_session, :session_url_for
+
+      prepend_around_action :monkeypatch_flash
+      prepend_around_action :auto_save_session
+    end
+
+    class_methods do
+      def link_nonce_type(value = :not_given)
+        if value == :not_given
+          @link_nonce_type || superclass.try(:link_nonce_type) || :nonce
+        else
+          @link_nonce_type = value
+        end
+      end
+    end
+
+    def save_session
+      current_session.try(:save)
+    end
+
+    def current_session(create_missing: true)
+      return @current_session if @current_session.present?
+
+      if params[:session_token]
+        payload = JSON.parse(session_cryptor.decrypt_and_verify(params[:session_token])).with_indifferent_access
+        matched_session = find_or_create_session(key: payload[:session_key])
+        if matched_session.present?
+          if payload[:token_type] == 'nonce' && matched_session.data[:link_nonce] == payload[:nonce]
+            @current_session = matched_session
+            @current_session.data[:link_nonce] = nil
+          elsif payload[:token_type] == 'fixed_ip' && matched_session.data[:remote_ip] == request.remote_ip &&
+            DateTime.parse(matched_session.data[:last_ip_token_requested]) > session_expiration_period_minutes.minutes.ago
+            @current_session = matched_session
+          elsif payload[:token_type] == 'expiring' && DateTime.parse(matched_session.data[:last_token_requested]) > session_expiration_period_minutes.minutes.ago
+            @current_session = matched_session
+          end
+        end
+        raise SessionNonceMismatch, "Session Not Found" unless @current_session.present?
+      elsif (session_key = params[:session_key] || session_key_header || flash[:session_key] || session[:session_key]).present?
+        @current_session = find_or_create_session(key: session_key)
+      end
+
+      @current_session ||= find_or_create_session(key: :create) if create_missing
+
+      @current_session
+    end
+
+    def current_session_data
+      current_session.data
+    end
+
+    def session_changed?
+      current_session.changed? && current_session.changes[:data].present?
+    end
+
+    def forbid_access_if_lacking_session
+      render plain: 'You should do an LTI Tool Launch.', status: :unauthorized unless valid_session?
+    end
+
+    def verify_authenticity_token
+      # No need to check CSRF when no cookies were sent. This fixes CSRF failures in Browsers
+      # that restrict Cookie setting within an IFrame.
+      return unless request.cookies.keys.length > 0
+      super
+    end
+
+    # Redirect with the session key intact. In production,
+    # handle this by adding a one-time use encrypted token to the URL.
+    # Keeping it in the URL in development means that it plays
+    # nicely with webpack-dev-server live reloading (otherwise
+    # you get an access error everytime it tries to live reload).
+
+    def redirect_with_session_to(*args)
+      redirect_to url_with_session(*args)
+    end
+
+    def link_with_session_to(*args)
+      helpers.link_to url_with_session(*args)
+    end
+
+    def session_url_for(*args)
+      url_for(build_session_url_params(*args))
+    end
+
+    def url_with_session(location, *args, route_context: self, **kwargs)
+      route_context.send(location, *build_session_url_params(*args, **kwargs))
+    end
+
+    def link_nonce(type: link_nonce_type)
+      type = instance_exec(&type) if type.is_a?(Proc)
+      type = type.to_s
+
+      @cached_link_nonces ||= {}
+      @cached_link_nonces[type] ||= begin
+        payload = {
+          token_type: type,
+          session_key: current_session.session_key,
+          organization_id: current_organization.id,
+        }
+
+        if type == 'nonce'
+          current_session_data[:link_nonce] = SecureRandom.hex
+          payload.merge!(nonce: current_session_data[:link_nonce])
+        elsif type == 'fixed_ip'
+          current_session_data[:remote_ip] ||= request.remote_ip
+          current_session_data[:last_ip_token_requested] = DateTime.now.iso8601
+        elsif type == 'expiring'
+          current_session_data[:last_token_requested] = DateTime.now.iso8601
+        else
+          raise StandardError, "Unsupported link_nonce_type: '#{type}'"
+        end
+
+        session_cryptor.encrypt_and_sign(payload.to_json)
+      end
+    end
+
+    def link_nonce_type
+      self.class.link_nonce_type
+    end
+
+    def session_expiration_period_minutes
+      15
+    end
+
+    private
+
+    def session_cryptor
+      secret_key_base = Rails.application.try(:secret_key_base) || Rails.application.secrets.secret_key_base
+      @session_cryptor ||= ActiveSupport::MessageEncryptor.new(secret_key_base[0..31])
+    end
+
+    def session_key_header
+      if match = request.headers['Authorization'].try(:match, /token=(.+)/)
+        match[1]
+      end
+    end
+
+    def build_session_url_params(*args, nonce_type: link_nonce_type, **kwargs)
+      if args[-1].is_a?(Hash)
+        args[-1] = args[-1].dup
+      else
+        args.push({})
+      end
+
+      if Rails.env.development?
+        args[-1].merge!(
+          session_key: current_session.session_key,
+          organization_id: current_organization.id,
+        )
+      else
+        args[-1].merge!(
+          session_token: link_nonce(type: nonce_type),
+          organization_id: current_organization.id,
+        )
+      end
+
+      args[-1].merge!(kwargs)
+      args
+    end
+
+    def auto_save_session
+      yield if block_given?
+      save_session if @current_session && session_changed?
+    end
+
+    def monkeypatch_flash
+      if valid_session? && (value = current_session_data['flashes']).present?
+        flashes = value["flashes"]
+        if discard = value["discard"]
+          flashes.except!(*discard)
+        end
+        flash.replace(flashes)
+        flash.discard()
+      end
+
+      yield
+
+      if @current_session.present?
+        current_session_data['flashes'] = flash.to_session_value
+        flash.discard()
+      end
+    end
+  end
+end

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "5.2.4"
+  VERSION = "5.3.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.2.4
+  version: 5.3.5
 platform: ruby
 authors:
 - Instructure ProServe
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-08-24 00:00:00.000000000 Z
+date: 2020-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -184,7 +184,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: 
+description:
 email:
 - pseng@instructure.com
 executables: []
@@ -237,6 +237,7 @@ files:
 - lib/panda_pal/helpers/controller_helper.rb
 - lib/panda_pal/helpers/route_helper.rb
 - lib/panda_pal/helpers/secure_headers.rb
+- lib/panda_pal/helpers/session_replacement.rb
 - lib/panda_pal/plugins.rb
 - lib/panda_pal/version.rb
 - lib/tasks/panda_pal_tasks.rake
@@ -291,7 +292,7 @@ homepage: http://instructure.com
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -307,7 +308,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.2
-signing_key: 
+signing_key:
 specification_version: 4
 summary: LTI mountable engine
 test_files: