panda_pal 5.3.6.beta3 → 5.3.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5b8cdbd0f383e4034cdeffcb5af9f818b5930d2979eab7cfdf707c3029b1088
-  data.tar.gz: 5c97a2978caec6d498cb32e3c65a094c9c96f95a1ccc799e7149d99e7de55dc1
+  metadata.gz: 13d3460a12f31ce93e9fba60f806871ba8e5507b43c8b761b06e34244b528215
+  data.tar.gz: c8a288d52fa8927835c8cf59561d9ff15a156631c09d9e556d561da0e55073f3
 SHA512:
-  metadata.gz: df073ebfec0f0b72116935ec44f100870aa2af93f825de3d8fda52e7e4978b19eff3597c6fa9f402287a56e8cf85ad6ee4ec8aee004f5a3b3c143942c86921b8
-  data.tar.gz: b947596b1eec82c8b3ee3173af999f29897b9fc834dd75b2c67d88056b0f96b68ea1fa66732345522eea9a9e9eba738f400396fcb25ce06cafb5027b07016db0
+  metadata.gz: 440a454305b5d1b1ed3c6b34e7ea2c9875be68eaf0bced9e59eef8734cb5590a8643e385d2e00cf11450397ec4e7aa10df08f9e0e57a8fff22fdb352354437a8
+  data.tar.gz: 5b89736e51f2cbe46fe6d2ebc088b95ddb24f30e7f2aef4f3b90356f8a13de4b8b728695cdfee9f393a4ff539461462a1944e2592db66038b9be5e86a7b9698f

data/README.md

@@ -26,7 +26,8 @@ LTI 1.3 has some additional configuration steps required to setup an LTI:
 
 1. If you're running Canvas locally, make sure the `config/redis.yml` and `config/dynamic_settings.yml` files exist in Canvas.
 2. In prod, you'll need to generate a RSA Private Key for the LTI to use. You can set the `LTI_PRIVATE_KEY` ENV variable, or manually set `PandaPal.lti_private_key = OpenSSL::PKey::RSA.new(key)`.
-3. Your PandaPal::Organization's `key` should be `CLIENT_ID/DEPLOYMENT_ID` (which can be found in Canvas). If a Deployment ID is not given, the key should just be `CLIENT_ID/`.
+3. Make sure you have Redis installed and linked correctly
+4. Your PandaPal::Organization's `key` should be `CLIENT_ID/DEPLOYMENT_ID` (which can be found in Canvas). If a Deployment ID is not given, the key should just be `CLIENT_ID`.
 
 ### Launch URL property
 LTI Spec: `The launch_url contains the URL to which the LTI Launch is to be sent.   The secure_launch_url is the URL to use if secure http is required.  One of either the launch_url or the secure_launch_url must be specified.`
@@ -92,10 +93,22 @@ The following routes should be added to the routes.rb file of the implementing L
 ```ruby
 # config/routes.rb
 mount PandaPal::Engine, at: '/lti'
-lti_nav account_navigation: 'accounts#launch' # Use lti_nav to provide a custom Launch implementation, otherwise use the url: param of stage_navigation to let PandaPal handle launch.
 root to: 'panda_pal/lti#launch'
+
+# Add Launch Endpoints:
+lti_nav account_navigation: 'accounts#launch', auto_launch: false # (LTI <1.3 Default)
+# -- OR --
+scope '/organizations/:organization_id' do
+  lti_nav account_navigation: 'accounts#launch_landing', auto_launch: true # (LTI 1.3 Default)
+  lti_nav account_navigation: 'accounts#launch_landing' # Automatically sets auto_launch to true because :organization_id is part of the path
+  # ...
+end
 ```
 
+`auto_launch`: Setting to `true` will tell PandaPal to handle all of the launch details and session creation, and then pass off to
+the defined action. Setting it to `false` indicates that the defined action handles launch validation and setup itself (this has been the legacy approach).
+Because `auto_launch: false` is most similar to the previous behavior, it is the default for LTI 1.0/1.1 LTIs. For LTI 1.3 LTIs, `auto_launch: true` is the default. If not specified and `:organization_id` is detected in the Route Path, `auto_launch` will be set to `true`
+
 ## Implementating data segregation
 This engine uses Apartment to keep data segregated between installations of the implementing LTI tool.
 By default, it does this by inspecting the path of the request, and matching URLs containing `orgs` or `organizations`,

data/app/controllers/panda_pal/lti_v1_p0_controller.rb

@@ -2,7 +2,7 @@ require_dependency "panda_pal/application_controller"
 
 module PandaPal
   class LtiV1P0Controller < ApplicationController
-    skip_forgery_protection
+    skip_before_action :verify_authenticity_token
 
     def launch
       current_session_data.merge!({

data/app/controllers/panda_pal/lti_v1_p3_controller.rb

@@ -2,7 +2,7 @@ require_dependency "panda_pal/application_controller"
 
 module PandaPal
   class LtiV1P3Controller < ApplicationController
-    skip_forgery_protection
+    skip_before_action :verify_authenticity_token
     before_action :validate_launch!, only: [:resource_link_request]
     around_action :switch_tenant, only: [:resource_link_request]
 
@@ -58,7 +58,12 @@ module PandaPal
         opts = LaunchUrlHelpers.normalize_lti_launch_desc(opts)
         opts.merge!({
           placement: k,
-          target_link_uri: LaunchUrlHelpers.absolute_launch_url(k.to_sym, host: parsed_request_url, launch_handler: v1p3_resource_link_request_path),
+          target_link_uri: LaunchUrlHelpers.absolute_launch_url(
+            k.to_sym,
+            host: parsed_request_url,
+            launch_handler: v1p3_resource_link_request_path,
+            default_auto_launch: true
+          ),
         })
         opts
       end

data/app/lib/lti_xml/base_platform.rb

@@ -85,8 +85,13 @@ module LtiXml
     end
 
     def ext_params(options, k)
-      options = LaunchUrlHelpers.normalize_lti_launch_desc(options)
-      options[:url] = PandaPal::LaunchUrlHelpers.absolute_launch_url(k.to_sym, host: parsed_request_url, launch_handler: nil)
+      options = PandaPal::LaunchUrlHelpers.normalize_lti_launch_desc(options)
+      options[:url] = PandaPal::LaunchUrlHelpers.absolute_launch_url(
+        k.to_sym,
+        host: parsed_request_url,
+        launch_handler: :v1p0_launch_path,
+        default_auto_launch: false
+      )
       options
     end
   end

data/app/lib/panda_pal/launch_url_helpers.rb

@@ -1,25 +1,26 @@
 module PandaPal
   module LaunchUrlHelpers
-    def self.absolute_launch_url(launch_type, host:, launch_handler: nil)
+    def self.absolute_launch_url(launch_type, host:, launch_handler: nil, default_auto_launch: false)
       opts = PandaPal.lti_paths[launch_type]
-      is_direct = opts[:no_redirect] || !launch_handler.present?
+      auto_launch = opts[:auto_launch] != nil ? opts[:auto_launch] : default_auto_launch
+      auto_launch = auto_launch && launch_handler.present?
 
-      if is_direct
-        final_url = launch_url(opts, launch_type: launch_type)
-        return final_url if URI.parse(final_url).absolute?
-        return [host.to_s, final_url].join
-      else
+      if auto_launch
         launch_handler = resolve_route(launch_handler) if launch_handler.is_a?(Symbol)
         return add_url_params([host.to_s, launch_handler].join, {
           launch_type: launch_type,
         })
+      else
+        final_url = launch_url(opts, launch_type: launch_type)
+        return final_url if URI.parse(final_url).absolute?
+        return [host.to_s, final_url].join
       end
     end
 
     def self.normalize_lti_launch_desc(opts)
       opts = opts.dup
       opts.delete(:route_helper_key)
-      opts.delete(:no_redirect)
+      opts.delete(:auto_launch)
       opts
     end
 

data/app/models/panda_pal/organization.rb

@@ -56,4 +56,6 @@ module PandaPal
       Apartment::Tenant.drop name
     end
   end
+
+  Organization.sync_schedules if Organization.respond_to?(:sync_schedules)
 end

data/app/models/panda_pal/organization_concerns/settings_validation.rb

@@ -99,6 +99,20 @@ module PandaPal
           errors.concat(val_errors)
         end
 
+        if settings.is_a?(Array)
+          if spec[:length].is_a?(Range)
+            errors << "#{human_path} should contain #{spec[:length]} items" unless spec[:length].include?(settings.count)
+          elsif spec[:length].is_a?(Numeric)
+            errors << "#{human_path} should contain exactly #{spec[:length]} items" unless spec[:length] == settings.count
+          end
+
+          if spec[:item] != nil
+            settings.each_with_index do |value, i|
+              validate_settings_level(settings[i], spec[:item], path: [*path, i], errors: errors)
+            end
+          end
+        end
+
         if settings.is_a?(Hash)
           if spec[:properties] != nil
             spec[:properties].each do |key, pspec|

data/app/models/panda_pal/organization_concerns/task_scheduling.rb

@@ -168,13 +168,17 @@ module PandaPal
         return nil unless cron_time.present?
 
         cron_time = instance_exec(&cron_time) if cron_time.is_a?(Proc)
-        if !Rufus::Scheduler.parse(cron_time).zone.present? && settings && settings[:timezone]
-          cron_time += " #{settings[:timezone]}"
+        if !Rufus::Scheduler.parse(cron_time).zone.present? && settings && settings_timezone
+          cron_time += " #{settings_timezone}"
         end
 
         cron_time
       end
 
+      def settings_timezone
+        settings[:timezone] || settings.dig(:canvas, :root_account_timezone).presence || nil
+      end
+
       class ScheduledTaskExecutor
         include Sidekiq::Worker
 

data/config/initializers/apartment.rb

@@ -10,8 +10,10 @@ Apartment.configure do |config|
 end
 
 Rails.application.config.middleware.use Apartment::Elevators::Generic, lambda { |request|
-  if match = request.path.match(/\/(?:orgs|organizations)\/(\d+)/)
+  if match = request.path.match(/\/(?:orgs?|organizations?)\/(\d+)/)
     PandaPal::Organization.find_by(id: match[1]).try(:name)
+  elsif request.path.starts_with?('/rails/active_storage/blobs/')
+    PandaPal::Organization.find_by(id: request.params['organization_id']).try(:name)
   end
 }
 

data/config/routes.rb

@@ -3,6 +3,7 @@ PandaPal::Engine.routes.draw do
 
   scope '/v1p0', as: 'v1p0' do
     get '/config' => 'lti_v1_p0#tool_config'
+    post '/launch' => 'lti_v1_p0#launch'
   end
 
   scope '/v1p3', as: 'v1p3' do

data/lib/panda_pal/helpers/controller_helper.rb

@@ -39,7 +39,11 @@ module PandaPal::Helpers
 
     def validate_v1p0_launch
       authorized = false
-      if @organization = params['oauth_consumer_key'] && PandaPal::Organization.find_by_key(params['oauth_consumer_key'])
+      # We should verify the timestamp is recent (within 5 minutes).  The approved timestamp is part of the signature,
+      # so we don't need to worry about malicious users messing with it.  We should deny requests that come too long
+      # after the approved timestamp.  
+      good_timestamp = params['oauth_timestamp'] && params['oauth_timestamp'].to_i > Time.now.to_i - 300
+      if @organization = good_timestamp && params['oauth_consumer_key'] && PandaPal::Organization.find_by_key(params['oauth_consumer_key'])
         sanitized_params = request.request_parameters
         # These params come over with a safari-workaround launch.  The authenticator doesn't like them, so clean them out.
         safe_unexpected_params = ["full_win_launch_requested", "platform_redirect_url", "dummy_param"]

data/lib/panda_pal/helpers/route_helper.rb

@@ -9,7 +9,12 @@ module PandaPal::Helpers::RouteHelper
     path = "#{base_path}/#{nav.to_s}"
 
     lti_options = options.delete(:lti_options) || {}
-    lti_options[:no_redirect] = options.delete(:no_redirect)
+    lti_options[:auto_launch] = options.delete(:auto_launch)
+
+    if lti_options[:auto_launch].nil?
+      lti_options[:auto_launch] = (@scope[:path] || '').include?(':organization_id')
+    end
+
     lti_options[:route_helper_key] = path.split('/').reject(&:empty?).join('_')
     post(path, options.dup, &block)
     get(path, options.dup, &block)

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "5.3.6.beta3"
+  VERSION = "5.3.11"
 end

data/panda_pal.gemspec

@@ -23,6 +23,7 @@ Gem::Specification.new do |s|
   s.add_dependency 'attr_encrypted', '~> 3.0.0'
   s.add_dependency 'secure_headers', '~> 6.1'
   s.add_dependency 'json-jwt'
+  s.add_dependency 'httparty'
 
   s.add_development_dependency 'sidekiq'
   s.add_development_dependency 'sidekiq-scheduler'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.3.6.beta3
+  version: 5.3.11
 platform: ruby
 authors:
 - Instructure ProServe
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-12-18 00:00:00.000000000 Z
+date: 2021-02-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -128,6 +128,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: httparty
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: sidekiq
   requirement: !ruby/object:Gem::Requirement
@@ -298,9 +312,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubygems_version: 3.0.3
 signing_key: