panda_pal 5.14.0.beta4 → 5.14.0.beta5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d4a90a987ce86beeffae59c66c350d8c1c3f4e4d0f18c63379a9f7e7014bc26
-  data.tar.gz: ea34c39f969a62ba8ce313fb316b6ae54dc6db3c6027dd683ad67191708484c6
+  metadata.gz: 3ca8324d890b7a0caa25e8b31216b21b441e1dd23003903c873ff34545b482bc
+  data.tar.gz: 4fbf36729ddb999aadad92c6b887ff9c731b81bbf97cb4eca434bfbae54d7c0f
 SHA512:
-  metadata.gz: 61f3853d04463655267c9107c07f819858daf4f21f06724a2e4d1a84623c74be983f9f69040f9cd7dc9231efef51f3b806e2390028fe7fcab7feb2ae0d4ef469
-  data.tar.gz: d68ed40aac052cecf6d972f201c949fc8766e365eecfb5ea7c0dbb835d477ee81ba26f0756e048250edd36ef029b83203a2fab6e57738dee9ff03b3aa23520bc
+  metadata.gz: dff58f780e6b55d11447d2844735c211380db9a9932b924e4cdd570a4f67c29a12d5b7f6097eac4df2792faa4bdc6ef23f4c18521348b0be1fdab65081076903
+  data.tar.gz: 2e6fba74bc5d48f2a32b316045ee070046704dfc81838762a43484a042b9cde1183cff6531041813dcd8787ae9db3dbf52775e3730e4b3f6ec830e9a9a8ad510

data/app/controllers/panda_pal/lti_v1_p3_controller.rb

@@ -9,7 +9,6 @@ module PandaPal
     end
 
     before_action ->{ validate_launch!(version: :v1p3) }, only: [:resource_link_request]
-    around_action :switch_tenant, only: [:resource_link_request]
     before_action :enforce_environment!, only: [:resource_link_request]
 
     # Redirect to beta/test as necessary

data/lib/panda_pal/engine.rb

@@ -58,15 +58,16 @@ module PandaPal
       class ::Object
         unless defined?(switch_tenant)
           def switch_tenant(tenant, &block)
-            if tenant.to_s.include?(":")
+            if tenant.is_a?(PandaPal::Organization)
+              org.switch_tenant(&block)
+            elsif (org = PandaPal::Organization.find_by(name: tenant)).present?
+              org.switch_tenant(&block)
+            else
               if block_given?
                 Apartment::Tenant.switch(tenant, &block)
               else
                 Apartment::Tenant.switch!(tenant)
               end
-            else
-              org = PandaPal::Organization.find_by(name: tenant)
-              org.switch_tenant(&block)
             end
           end
         end

data/lib/panda_pal/helpers/controller_helper.rb

@@ -69,39 +69,41 @@ module PandaPal::Helpers
     def validate_v1p3_launch
       require "json/jwt"
 
-      decoded_jwt = JSON::JWT.decode(params.require(:id_token), :skip_verification)
-      raise JSON::JWT::VerificationFailed, 'error decoding id_token' if decoded_jwt.blank?
+      switch_tenant("public") do
+        decoded_jwt = JSON::JWT.decode(params.require(:id_token), :skip_verification)
+        raise JSON::JWT::VerificationFailed, 'error decoding id_token' if decoded_jwt.blank?
 
-      client_id = decoded_jwt['aud']
-      deployment_id = decoded_jwt['https://purl.imsglobal.org/spec/lti/claim/deployment_id']
+        client_id = decoded_jwt['aud']
+        deployment_id = decoded_jwt['https://purl.imsglobal.org/spec/lti/claim/deployment_id']
 
-      if deployment_id.present?
-        @organization ||= PandaPal::Organization.find_by(key: "#{client_id}/#{deployment_id}")
-        @organization ||= PandaPal::Organization.find_by(key: deployment_id)
-      end
+        if deployment_id.present?
+          @organization ||= PandaPal::Organization.find_by(key: "#{client_id}/#{deployment_id}")
+          @organization ||= PandaPal::Organization.find_by(key: deployment_id)
+        end
 
-      @organization ||= PandaPal::Organization.find_by(key: client_id)
+        @organization ||= PandaPal::Organization.find_by(key: client_id)
 
-      params[:session_key] = params[:state]
+        params[:session_key] = params[:state]
 
-      raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present?
-      raise JSON::JWT::VerificationFailed, 'Organization does not trust platform' unless @organization.trusted_platform?(current_lti_platform)
+        raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present?
+        raise JSON::JWT::VerificationFailed, 'Organization does not trust platform' unless @organization.trusted_platform?(current_lti_platform)
 
-      begin
-        decoded_jwt.verify!(current_lti_platform.public_jwks)
-      rescue JSON::JWK::Set::KidNotFound
-        decoded_jwt.verify!(current_lti_platform.public_jwks(force: true))
-      end
+        begin
+          decoded_jwt.verify!(current_lti_platform.public_jwks)
+        rescue JSON::JWK::Set::KidNotFound
+          decoded_jwt.verify!(current_lti_platform.public_jwks(force: true))
+        end
 
-      raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session.panda_pal_organization_id == 0
-      raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session[:lti_oauth_nonce] == decoded_jwt['nonce']
+        raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session.panda_pal_organization_id == 0
+        raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session[:lti_oauth_nonce] == decoded_jwt['nonce']
 
-      jwt_verifier = PandaPal::LtiJwtValidator.new(decoded_jwt, client_id)
-      raise JSON::JWT::VerificationFailed, jwt_verifier.errors unless jwt_verifier.valid?
+        jwt_verifier = PandaPal::LtiJwtValidator.new(decoded_jwt, client_id)
+        raise JSON::JWT::VerificationFailed, jwt_verifier.errors unless jwt_verifier.valid?
 
-      # Migrate the session to the correct tenant
-      login_session = current_panda_session
-      login_session.delete
+        # Migrate the session to the correct tenant
+        login_session = current_panda_session
+        login_session.delete
+      end
 
       @organization.switch_tenant
 
@@ -126,8 +128,7 @@ module PandaPal::Helpers
     def switch_tenant(organization = current_organization, &block)
       return unless organization
       raise 'This method should be called in an around_action callback' unless block_given?
-
-      organization.switch_tenant(&block)
+      super
     end
 
     def forbid_access_if_lacking_session

data/lib/panda_pal/helpers/session_replacement.rb

@@ -58,6 +58,7 @@ module PandaPal::Helpers
 
         if type == 'KEY'
           @current_session = PandaPal::Session.find_by(session_secret: sig)
+          raise SessionNonceMismatch, "Session Not Found" unless @current_session.present?
           raise SessionNonceMismatch, "Session Not Found" if session_id && @current_session.id != session_id
         else
           session_record = PandaPal::Session.find_by(id: session_id)
@@ -76,6 +77,9 @@ module PandaPal::Helpers
             raise SessionNonceMismatch, "Invalid Method" unless request.method == :get
 
             # Verify the signature against the request URL
+            # The usig doesn't _need_ to be signed (since it's part of the payload that is already signed),
+            #   but this was an easy way to make the value a constant length. Any basic hashing function could solve this,
+            #   but the HMAC implementation was already available.
             resigned = generate_signed_url(session_record.signing_key, request.url)
             raise SessionNonceMismatch, "Invalid Signature" unless resigned == decoded_header['usig']
 
@@ -85,6 +89,7 @@ module PandaPal::Helpers
           elsif type == "T-NONCE"
             raise SessionNonceMismatch, "Invalid Nonce" unless session_record.data[:link_nonce] == decoded_header['nnc']
             @current_session = session_record
+            @current_session.data[:link_nonce] = nil
           elsif type == "T-IP"
             raise SessionNonceMismatch, "Invalid IP" unless decoded_header["ip"] == request.remote_ip
             @current_session = session_record

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "5.14.0.beta4"
+  VERSION = "5.14.0.beta5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.14.0.beta4
+  version: 5.14.0.beta5
 platform: ruby
 authors:
 - Instructure CustomDev
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-18 00:00:00.000000000 Z
+date: 2025-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails