panda_pal 5.3.4 → 5.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c598919f88d72cc23c02724fe9689b051ee82d553b8328e528253ec8e4f6622
-  data.tar.gz: 24b76f1904796d1672cb060482f63fc76fa56d34e8b248aad9480ac01e21fa3c
+  metadata.gz: 751203d046fbd547e8f194feabb335a81a08be96f6a557712f1673d139576a29
+  data.tar.gz: b06b642432ce0d1e4a42a4bc93520b3782c6d8cce801e91508b296be60501482
 SHA512:
-  metadata.gz: 75ea92798635fa208e51fc29d492c37fc8b75429b97a8e9e814e07b95e393d26aa03fe1599c42ed4a5dcbd1cb85b2d438a4d8a99ae17d885b7791c0458c4c749
-  data.tar.gz: 2cabc475ece25dadd88da19d3667e80a0f2d94d875d85cf05b244d692b0438771140cf4b9cc9d355f46c46aeca98583cb96323d7ee58c81eed8074cc7a7b87b8
+  metadata.gz: cc338a137cec8f7abb900b801ace89f1588b265d534babf98f6bb940307289b8a3175a9ce0d5d70a5ddeb520f3525d13e1ba0f7e52df34e75c6fda40ca03a3de
+  data.tar.gz: 717e7355ae2cfb990f40c589df6c29c138f55d660fa0095367a275e000a7041e98e99ec631f6dd1bf9e9f3068c7a01006d4a3580ac017cb358a18b9c9711a87f

data/README.md

@@ -376,6 +376,24 @@ You will want to watch out for a few scenarios:
       link_to "Name", url_with_session(:somewhere_else_path, arg, kwarg: 1)
     ```
 
+Persistent sessions have session_tokens as a way to safely communicate a session key in a way that is hopefully not too persistent in case it is logged somewhere.
+Options for communicating session_token -
+:nonce (default) - each nonce is good for exactly one communication with the backend server.  Once the nonce is used, it is no longer valid.
+:fixed_ip - each session_token is good until it expires.  It must be used from the same ip the LTI launched from.
+:expiring - this is the least secure.  Each token is good until it expires.
+
+For :fixed_ip and :expiring tokens you can override the default expiration period of 15 minutes.
+
+See the following example of how to override the link_nonce_type and token expiration length.
+
+class ApplicationController < ActionController::Base
+  link_nonce_type :fixed_ip
+  def session_expiration_period_minutes
+    120
+  end
+...
+end
+
 ### Previous Safari Instructions
 Safari is weird and you'll potentially run into issues getting `POST` requests to properly validate CSRF if you don't do the following:
 

data/lib/panda_pal/helpers/controller_helper.rb

@@ -62,7 +62,7 @@ module PandaPal::Helpers
       raise JSON::JWT::VerificationFailed, 'error decoding id_token' if decoded_jwt.blank?
 
       client_id = decoded_jwt['aud']
-      @organization = PandaPal::Organization.find_by!(key: 'PandaPal') # client_id)
+      @organization = PandaPal::Organization.find_by!(key: client_id)
       raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present?
 
       decoded_jwt.verify!(current_lti_platform.public_jwks)

data/lib/panda_pal/helpers/session_replacement.rb

@@ -32,13 +32,14 @@ module PandaPal::Helpers
       if params[:session_token]
         payload = JSON.parse(session_cryptor.decrypt_and_verify(params[:session_token])).with_indifferent_access
         matched_session = find_or_create_session(key: payload[:session_key])
-
         if matched_session.present?
           if payload[:token_type] == 'nonce' && matched_session.data[:link_nonce] == payload[:nonce]
             @current_session = matched_session
             @current_session.data[:link_nonce] = nil
           elsif payload[:token_type] == 'fixed_ip' && matched_session.data[:remote_ip] == request.remote_ip &&
-            DateTime.parse(matched_session.data[:last_ip_token_requested]) > 15.minutes.ago
+            DateTime.parse(matched_session.data[:last_ip_token_requested]) > session_expiration_period_minutes.minutes.ago
+            @current_session = matched_session
+          elsif payload[:token_type] == 'expiring' && DateTime.parse(matched_session.data[:last_token_requested]) > session_expiration_period_minutes.minutes.ago
             @current_session = matched_session
           end
         end
@@ -111,6 +112,8 @@ module PandaPal::Helpers
         elsif type == 'fixed_ip'
           current_session_data[:remote_ip] ||= request.remote_ip
           current_session_data[:last_ip_token_requested] = DateTime.now.iso8601
+        elsif type == 'expiring'
+          current_session_data[:last_token_requested] = DateTime.now.iso8601
         else
           raise StandardError, "Unsupported link_nonce_type: '#{type}'"
         end
@@ -123,6 +126,10 @@ module PandaPal::Helpers
       self.class.link_nonce_type
     end
 
+    def session_expiration_period_minutes
+      15
+    end
+
     private
 
     def session_cryptor

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "5.3.4"
+  VERSION = "5.3.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.3.4
+  version: 5.3.5
 platform: ruby
 authors:
 - Instructure ProServe
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-09-30 00:00:00.000000000 Z
+date: 2020-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails