panda_pal 5.16.20 → 5.16.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac02fef85d3184d63c9c8573a8695e52a424678747ab7a541a5f9483167ccc18
-  data.tar.gz: 54c1fbd8ad4d2f352f1d9b2843ef4c2705c63c8892942cedc8e5784840cb7820
+  metadata.gz: 7a5f35f89d8e121395cef557e6305357a29eab6ea9a63434ec3a38548c92d566
+  data.tar.gz: 6fccf06a199c9c59c01ebb0981cbfb4f86b374303cd7a30521fa0fa604705b9c
 SHA512:
-  metadata.gz: c64c54373faafee3164496661d8bed6ae5a68d2852296966b1ffef4d738c82f29c675694bcbf0f7bc5f7c22246c6cacedc676393a7bcfa7bb4fd998d0033bcd5
-  data.tar.gz: aeb94f2be05936dc753d66172426d028ae1b47417410c506e819b76b40c8adb8932fb0ec8dc9933497b676f414794cc285ba36408daad537ca18ef0c2febeb9a
+  metadata.gz: 4b23c1838a9a7b19a8c82d0f57f24d5c2b97ed4d2265379c52832b00ce7fd742bad1388d0697391a594908e2a1dac0f3b65c28cbbf1d2dbe6d1ec3ae6ba2cd68
+  data.tar.gz: 578b81b0921ae8fa4ed8b8bb99ed2c00326fa354c08dc8ff9aca4d354a752aded035aee21658654283369bf29e74eee17b7ba4f900e8ad8fe6594d55ead280fd

data/app/models/panda_pal/platform/canvas.rb

@@ -38,7 +38,7 @@ module PandaPal
     end
 
     def is_trusted_env?
-      return true unless Rails.env.production?
+      return true if Rails.env.development? || Rails.env.test?
 
       TRUSTED_ISSUERS.include?(platform_uri)
     end

data/app/models/panda_pal/platform.rb

@@ -96,6 +96,8 @@ module PandaPal
   end
 
   class Platform::Generic < Platform
+    attr_reader :options
+
     def self.from_urls(base_url, jwks: nil, auth_redirect: nil, grant: nil)
       new({
         base_url: base_url,

data/app/models/panda_pal/session.rb

@@ -152,7 +152,7 @@ module PandaPal
     end
 
     def sign_value(data)
-      OpenSSL::HMAC.base64digest(OpenSSL::Digest.new('sha256'), signing_key, data)
+      Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), signing_key, data))
     end
 
     def validate_signature(data, signature)

data/config/initializers/apartment.rb

@@ -130,6 +130,12 @@ module Apartment
         raise ActiveRecord::StatementInvalid, "Could not find schema for tenant #{tenant} (#{tenant_schemas.inspect})" unless schema_exists?(tenant_schemas)
 
         Apartment.connection.schema_search_path = full_search_path
+      rescue ActiveRecord::ConnectionNotEstablished
+        # Connection-acquisition failures (e.g. pool checkout timeouts) are unrelated to schema/search-path
+        # resolution. Let them propagate as themselves instead of masking them as Apartment::TenantNotFound,
+        # which sends whoever's debugging the error looking for a schema/tenant problem that doesn't exist.
+        @current = current_tenant
+        raise
       rescue *rescuable_exceptions => e
         @current = current_tenant
         raise_schema_connect_to_new(tenant, e)

data/lib/panda_pal/engine.rb

@@ -94,18 +94,18 @@ module PandaPal
         end
 
         def _panda_pal_console_env
-          if Rails.env.production?
-            env = ENV["SENTRY_CURRENT_ENV"].presence || "PROD"
+          if Rails.env.development?
+            PandaPal::ConsoleHelpers.cyan("dev")
+          elsif Rails.env.test?
+            PandaPal::ConsoleHelpers.cyan("test")
+          else
+            env = ENV["SENTRY_CURRENT_ENV"].presence || Rails.env.upcase || "PROD"
 
             if env.downcase.include?("prod")
               PandaPal::ConsoleHelpers.red(env)
             else
               PandaPal::ConsoleHelpers.cyan(env)
             end
-          elsif Rails.env.development?
-            PandaPal::ConsoleHelpers.cyan("dev")
-          elsif Rails.env.test?
-            PandaPal::ConsoleHelpers.cyan("test")
           end
         end
 

data/lib/panda_pal/helpers/secure_headers.rb

@@ -5,7 +5,7 @@ module PandaPal
       # The default cookie headers aren't compatable with PandaPal cookies currenntly
       config.cookies = { samesite: { none: true } }
 
-      if Rails.env.production?
+      unless Rails.env.development? || Rails.env.test?
         config.cookies[:secure] = true
       end
 

data/lib/panda_pal/helpers/session_replacement.rb

@@ -57,7 +57,7 @@ module PandaPal::Helpers
       current_panda_session
 
       if !@current_session && create_missing
-        Rails.logger.warn("current_session(create_missing: true) is deprecated. Use start_panda_session! instead.") unless Rails.env.production?
+        Rails.logger.warn("current_session(create_missing: true) is deprecated. Use start_panda_session! instead.") if Rails.env.development? || Rails.env.test?
         start_panda_session!
       end
 

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = '5.16.20'
+  VERSION = '5.16.21'
 end

data/panda_pal.gemspec

@@ -23,8 +23,8 @@ Gem::Specification.new do |s|
   s.add_dependency "rails", ">= 4.2"
   s.add_dependency 'ros-apartment', '~> 3.0'
   s.add_dependency 'ims-lti', '~> 1.2.4'
-  s.add_dependency 'browser', '2.5.0'
-  s.add_dependency 'attr_encrypted', '~> 4.0.0'
+  s.add_dependency 'browser', '~> 5.3'
+  s.add_dependency 'attr_encrypted', '~> 4.2'
   s.add_dependency 'secure_headers', '>= 6.1', '< 8'
   s.add_dependency 'jwt'
   s.add_dependency 'httparty'

data/spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb

@@ -0,0 +1,110 @@
+require 'spec_helper'
+
+RSpec.describe "PandaPal::LtiV1P0Controller", type: :request do
+  let(:organization) { create(:panda_pal_organization) }
+  let(:launch_url) { panda_pal.v1p0_launch_url(host: 'www.example.com') }
+
+  # Signs a full LTI v1p0 launch params hash the same way an LMS (Tool Consumer)
+  # would, using the platform-side half of the very same `ims-lti` gem that
+  # PandaPal uses on the tool-provider side to validate incoming launches.
+  def signed_launch_params(secret:, timestamp: Time.now.to_i, launch_type: 'panda_pal')
+    consumer = IMS::LTI::ToolConsumer.new(organization.key, secret, {
+      'resource_link_id' => 'test-resource-link-id',
+    })
+    consumer.launch_url = launch_url
+    consumer.timestamp = timestamp
+    # `launch_type` isn't a spec'd LTI param, but the controller reads it from
+    # params, so it must be included in the signed payload or the signature
+    # PandaPal recomputes on the real request body won't match.
+    consumer.set_non_spec_param('launch_type', launch_type)
+    consumer.generate_launch_data
+  end
+
+  after do
+    # `validate_v1p0_launch` permanently switches the Apartment tenant to the
+    # organization's schema on a successful launch (PandaPal::Organization
+    # #switch_tenant with no block => Apartment::Tenant.switch!). Reset it so
+    # this doesn't leak into other spec files run later in the suite.
+    Apartment::Tenant.reset
+  end
+
+  describe 'POST /v1p0/launch' do
+    context 'with a validly-signed launch' do
+      it 'passes signature validation, starts a session, and redirects instead of rendering the 401 body' do
+        params = signed_launch_params(secret: organization.secret)
+
+        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
+
+        expect(response).not_to have_http_status(:unauthorized)
+        expect(response.body).not_to include('Failed to validate LTI v1p0 launch')
+        expect(response).to have_http_status(:found)
+        expect(response.headers['Location']).to include('/panda_pal')
+
+        # The session record is created after PandaPal switches Apartment tenants
+        # to the organization's own schema, so look it up there.
+        session_count = organization.switch_tenant { PandaPal::Session.count }
+        expect(session_count).to eq(1)
+      end
+    end
+
+    context 'with an invalid signature (wrong secret used to sign)' do
+      it 'renders 401 with the failure body' do
+        params = signed_launch_params(secret: 'not-the-real-secret')
+
+        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
+      end
+    end
+
+    context 'with a tampered parameter after signing' do
+      it 'renders 401 with the failure body' do
+        params = signed_launch_params(secret: organization.secret)
+        params['resource_link_id'] = 'a-different-resource-link-id'
+
+        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
+      end
+    end
+
+    context 'with a stale oauth_timestamp' do
+      it 'renders 401 without ever consulting IMS::LTI::ToolProvider' do
+        stale_timestamp = 400.seconds.ago.to_i
+        params = signed_launch_params(secret: organization.secret, timestamp: stale_timestamp)
+
+        expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+        post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: params
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.body).to eq('Failed to validate LTI v1p0 launch')
+      end
+    end
+  end
+
+  describe 'safari_override (browser gem regression coverage)' do
+    let(:safari_user_agent) do
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15"
+    end
+    let(:chrome_user_agent) do
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
+    end
+
+    # safari_override is the very first thing validate_launch! does, before any
+    # OAuth/org checks, so an otherwise-invalid launch is sufficient to exercise it.
+    it 'applies the secure_headers safari override when the User-Agent is Safari' do
+      expect_any_instance_of(PandaPal::LtiV1P0Controller).to receive(:use_secure_headers_override).with(:safari_override)
+
+      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => safari_user_agent }
+    end
+
+    it 'does not apply the override for a non-Safari User-Agent (Chrome)' do
+      expect_any_instance_of(PandaPal::LtiV1P0Controller).not_to receive(:use_secure_headers_override)
+
+      post panda_pal.v1p0_launch_path(host: 'www.example.com'), params: {}, headers: { 'User-Agent' => chrome_user_agent }
+    end
+  end
+end

data/spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb

@@ -0,0 +1,78 @@
+require 'spec_helper'
+require 'nokogiri'
+
+RSpec.describe "PandaPal::LtiV1P3Controller", type: :request do
+  describe 'GET /v1p3/public_jwks' do
+    let(:rsa_key) { OpenSSL::PKey::RSA.new(2048) }
+    let(:test_jwk) { JWT::JWK.new(rsa_key, { use: 'sig', alg: 'RS256' }) }
+
+    before { PandaPal.jwk = test_jwk }
+
+    after do
+      # PandaPal.jwk memoizes into a class variable (`@@jwk ||= ...`). Reset it
+      # so our test key doesn't leak into other spec files run later in the suite.
+      PandaPal.jwk = nil
+    end
+
+    it 'renders a 200 JSON JWK Set whose key matches PandaPal.jwk, with no private key material' do
+      get "/panda_pal/v1p3/public_jwks"
+
+      expect(response).to have_http_status(:ok)
+
+      expected_body = JSON.parse(JWT::JWK::Set.new(test_jwk).export.to_json)
+      body = JSON.parse(response.body)
+
+      expect(body).to eq(expected_body)
+      expect(body['keys']).to be_an(Array)
+      expect(body['keys'].length).to eq(1)
+
+      returned_key = body['keys'].first
+      expect(returned_key['kty']).to eq('RSA')
+      expect(returned_key['use']).to eq('sig')
+      expect(returned_key['alg']).to eq('RS256')
+      expect(returned_key['n']).to eq(test_jwk[:n])
+      expect(returned_key['e']).to eq(test_jwk[:e])
+      # Only the public modulus/exponent should ever be exposed - never private key material.
+      expect(returned_key.keys).not_to include('d', 'p', 'q', 'dp', 'dq', 'qi')
+    end
+  end
+
+  describe 'GET /v1p3/oidc_login' do
+    let(:login_params) do
+      {
+        client_id: 'test-client-id',
+        login_hint: 'test-login-hint',
+        lti_message_hint: 'test-lti-message-hint',
+        iss: 'https://canvas.instructure.com',
+      }
+    end
+
+    it 'renders the auto-submit form targeting the platform auth redirect URL, with the expected hidden fields' do
+      get "/panda_pal/v1p3/oidc_login", params: login_params
+
+      expect(response).to have_http_status(:ok)
+
+      doc = Nokogiri::HTML(response.body)
+      form = doc.at_css('form#redirect-form')
+      expect(form).not_to be_nil
+
+      created_session = PandaPal::Session.order(:id).last
+      expect(created_session).not_to be_nil
+
+      expect(form['action']).to eq(PandaPal::Platform::Canvas.new(iss: 'https://canvas.instructure.com').authentication_redirect_url)
+
+      hidden_fields = form.css('input[type=hidden]').each_with_object({}) do |input, h|
+        h[input['name']] = input['value']
+      end
+
+      expect(hidden_fields['client_id']).to eq('test-client-id')
+      expect(hidden_fields['login_hint']).to eq('test-login-hint')
+      expect(hidden_fields['lti_message_hint']).to eq('test-lti-message-hint')
+      expect(hidden_fields['scope']).to eq('openid')
+      expect(hidden_fields['response_type']).to eq('id_token')
+      expect(hidden_fields['state']).to eq(created_session.session_key)
+      expect(hidden_fields['nonce']).to eq(created_session[:lti_oauth_nonce])
+      expect(hidden_fields['nonce']).not_to be_blank
+    end
+  end
+end

data/spec/core/apartment_multidb_spec.rb

@@ -68,4 +68,33 @@ RSpec.describe PandaPal::Organization, type: :model do
       end
     end
   end
+
+  context "tenant switch error wrapping" do
+    around do |example|
+      original = Apartment.with_multi_server_setup
+      Apartment.configure { |c| c.with_multi_server_setup = true }
+      Apartment::Tenant.reload!
+      example.run
+    ensure
+      Apartment.configure { |c| c.with_multi_server_setup = original }
+      Apartment::Tenant.reload!
+    end
+
+    it "does not mask a connection pool timeout as Apartment::TenantNotFound (PFS-31252)" do
+      adapter = Apartment::Tenant.adapter
+      previous_tenant = adapter.current
+
+      allow(ActiveRecord::Base).to receive(:connection) do
+        # Un-stub before raising: ActiveRecord::Base.connection is inherited by
+        # ros-apartment's SeparateDbConnectionHandler (used for schema create/drop),
+        # so leaving the stub in place past this one intended failure would misroute
+        # unrelated connection lookups made elsewhere.
+        allow(ActiveRecord::Base).to receive(:connection).and_call_original
+        raise ActiveRecord::ConnectionTimeoutError, "could not obtain a connection from the pool within 5.000 seconds"
+      end
+
+      expect { adapter.connect_to_new("alt:some_org") }.to raise_error(ActiveRecord::ConnectionTimeoutError)
+      expect(adapter.current).to eq(previous_tenant)
+    end
+  end
 end

data/spec/factories/panda_pal_sessions.rb

@@ -1,7 +1,6 @@
 FactoryBot.define do
   factory :panda_pal_session, class: 'PandaPal::Session' do
-    session_secret { "MyString" }
-    organization { nil }
+    panda_pal_organization { nil }
     data { "MyText" }
   end
 end

data/spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb

@@ -0,0 +1,83 @@
+require 'spec_helper'
+
+module PandaPal::Jobs
+  RSpec.describe GradePassbackJob, type: :job do
+    let(:organization) { create(:panda_pal_organization) }
+    let(:job) { described_class.new }
+
+    describe '#perform' do
+      context 'with missing required params' do
+        it 'raises MissingGradePassbackParams when passback_guid is missing' do
+          expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+          expect {
+            job.perform(organization, { passback_url: 'http://example.com/passback', score: 0.9 })
+          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
+        end
+
+        it 'raises MissingGradePassbackParams when passback_url is missing' do
+          expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+          expect {
+            job.perform(organization, { passback_guid: 'guid-123', score: 0.9 })
+          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
+        end
+
+        it 'raises MissingGradePassbackParams when both score and total_score are missing' do
+          expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+          expect {
+            job.perform(organization, { passback_guid: 'guid-123', passback_url: 'http://example.com/passback' })
+          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
+        end
+
+        it 'raises MissingGradePassbackParams when opts is entirely empty' do
+          expect(IMS::LTI::ToolProvider).not_to receive(:new)
+
+          expect {
+            job.perform(organization, {})
+          }.to raise_error(PandaPal::Jobs::MissingGradePassbackParams)
+        end
+      end
+
+      context 'with valid options' do
+        let(:opts) { { passback_guid: 'guid-123', passback_url: 'http://example.com/passback', score: 0.9 } }
+        let(:tool_provider_double) { double('IMS::LTI::ToolProvider') }
+
+        before do
+          allow(IMS::LTI::ToolProvider).to receive(:new)
+            .with(organization.key, organization.secret, hash_including(
+              'lis_result_sourcedid' => opts[:passback_guid],
+              'lis_outcome_service_url' => opts[:passback_url]
+            ))
+            .and_return(tool_provider_double)
+        end
+
+        it 'posts to the LMS and does not raise when the response is successful' do
+          success_result = double('OutcomeResponse', success?: true)
+          expect(tool_provider_double).to receive(:post_extended_replace_result!).with(opts).and_return(success_result)
+
+          expect {
+            job.perform(organization, opts)
+          }.not_to raise_error
+        end
+
+        it 'raises GradePassbackFailure when the tool provider reports failure' do
+          failure_result = double(
+            'OutcomeResponse',
+            success?: false,
+            response_code: 500,
+            code_major: 'failure',
+            severity: 'error',
+            description: 'boom'
+          )
+          expect(tool_provider_double).to receive(:post_extended_replace_result!).with(opts).and_return(failure_result)
+
+          expect {
+            job.perform(organization, opts)
+          }.to raise_error(PandaPal::Jobs::GradePassbackFailure)
+        end
+      end
+    end
+  end
+end

data/spec/lib/panda_pal/helpers/secure_headers_spec.rb

@@ -0,0 +1,77 @@
+require 'spec_helper'
+
+RSpec.describe PandaPal::SecureHeaders do
+  subject(:config) { SecureHeaders::Configuration.new }
+
+  describe '.apply_defaults' do
+    before { described_class.apply_defaults(config) }
+
+    it 'returns the same configuration object it was given' do
+      expect(described_class.apply_defaults(config)).to equal(config)
+    end
+
+    it 'relaxes the default cookie samesite restriction for LTI iframes' do
+      expect(config.cookies).to eq(samesite: { none: true })
+    end
+
+    it 'does not mark cookies secure outside of production' do
+      expect(config.cookies[:secure]).to be_nil
+    end
+
+    it 'allows the app to be embedded in LTI iframes' do
+      expect(config.x_frame_options).to eq('ALLOWALL')
+    end
+
+    it 'sets baseline browser protection headers' do
+      expect(config.x_content_type_options).to eq('nosniff')
+      expect(config.x_xss_protection).to eq('1; mode=block')
+      expect(config.referrer_policy).to eq(%w(origin-when-cross-origin strict-origin-when-cross-origin))
+    end
+
+    it 'restricts default_src, connect_src, and script_src to self' do
+      expect(config.csp[:default_src]).to include("'self'")
+      expect(config.csp[:connect_src]).to include("'self'")
+      expect(config.csp[:script_src]).to include("'self'")
+    end
+
+    it 'allows inline styles and Google Fonts for CSS-in-JS libraries' do
+      expect(config.csp[:style_src]).to include("'self'", "'unsafe-inline'", 'blob:', 'https://fonts.googleapis.com')
+      expect(config.csp[:font_src]).to include("'self'", 'data:', 'https://fonts.gstatic.com')
+    end
+
+    it 'does not add development-only CSP allowances outside of development' do
+      expect(config.csp[:script_src]).not_to include("'unsafe-eval'")
+      expect(config.csp[:connect_src]).not_to include('http://localhost:3035')
+    end
+  end
+
+  describe '.apply_defaults in production' do
+    around do |example|
+      original_env = Rails.env
+      begin
+        Rails.env = 'production'
+        example.run
+      ensure
+        Rails.env = original_env
+      end
+    end
+
+    it 'marks cookies as secure' do
+      described_class.apply_defaults(config)
+      expect(config.cookies[:secure]).to be true
+    end
+  end
+
+  describe '.csp_entry' do
+    it 'merges values into the directive without duplicating existing entries' do
+      config.csp[:default_src] = ["'self'"]
+      described_class.instance_variable_set(:@config, config)
+
+      described_class.send(:csp_entry, :default_src, "'self'", 'https://example.com')
+
+      expect(config.csp[:default_src]).to eq(["'self'", 'https://example.com'])
+    ensure
+      described_class.instance_variable_set(:@config, nil)
+    end
+  end
+end

data/spec/models/panda_pal/platform_spec.rb

@@ -0,0 +1,152 @@
+require 'spec_helper'
+
+module PandaPal
+  RSpec.describe Platform, type: :model do
+    describe '.resolve_platform / .resolve_platform_class' do
+      context 'with the default configuration (no :platform option set)' do
+        it 'resolves to the Canvas platform class' do
+          expect(Platform.resolve_platform_class(iss: 'https://canvas.instructure.com')).to eq(Platform::Canvas)
+        end
+
+        it 'resolves to an instance of the Canvas platform, initialized with the issuer' do
+          resolved = Platform.resolve_platform(iss: 'https://canvas.instructure.com')
+
+          expect(resolved).to be_a(Platform::Canvas)
+          expect(resolved.platform_uri).to eq('https://canvas.instructure.com')
+        end
+      end
+
+      context 'when :platform is configured as a class name string' do
+        before do
+          PandaPal.lti_options = PandaPal.lti_options.merge(platform: 'PandaPal::Platform::Generic')
+        end
+
+        it 'resolves to that class' do
+          expect(Platform.resolve_platform_class(iss: 'https://lms.example.com')).to eq(Platform::Generic)
+        end
+
+        it 'resolves to an instance of that class' do
+          resolved = Platform.resolve_platform(iss: 'https://lms.example.com')
+          expect(resolved).to be_a(Platform::Generic)
+        end
+      end
+
+      context 'when :platform is configured as a Proc' do
+        it 'uses the class returned by the proc' do
+          PandaPal.lti_options = PandaPal.lti_options.merge(
+            platform: proc { |params| params[:iss] == 'https://special.example.com' ? Platform::Generic : nil }
+          )
+
+          expect(Platform.resolve_platform_class(iss: 'https://special.example.com')).to eq(Platform::Generic)
+        end
+
+        it 'falls through to the trusted-issuer default when the proc returns nil' do
+          PandaPal.lti_options = PandaPal.lti_options.merge(platform: proc { |_params| nil })
+
+          expect(Platform.resolve_platform_class(iss: 'https://canvas.beta.instructure.com')).to eq(Platform::Canvas)
+        end
+      end
+
+      context 'when :platform is configured as a Symbol' do
+        before do
+          Object.define_singleton_method(:panda_pal_spec_platform_resolver) { |_params| Platform::Generic }
+          PandaPal.lti_options = PandaPal.lti_options.merge(platform: :panda_pal_spec_platform_resolver)
+        end
+
+        after do
+          Object.singleton_class.send(:remove_method, :panda_pal_spec_platform_resolver)
+        end
+
+        it 'calls the named method on Object and uses the returned class' do
+          expect(Platform.resolve_platform_class(iss: 'https://lms.example.com')).to eq(Platform::Generic)
+        end
+      end
+
+      context 'when the configured platform string does not resolve to a class' do
+        before do
+          PandaPal.lti_options = PandaPal.lti_options.merge(platform: 'NotARealPlatformClassXYZ')
+        end
+
+        it 'falls back to Canvas for a trusted Canvas issuer' do
+          expect(Platform.resolve_platform_class(iss: 'https://canvas.beta.instructure.com')).to eq(Platform::Canvas)
+        end
+
+        it 'raises for an untrusted issuer' do
+          expect {
+            Platform.resolve_platform_class(iss: 'https://not-trusted.example.com')
+          }.to raise_error(RuntimeError, /Unknown platform/)
+        end
+      end
+    end
+
+    describe Platform::Generic do
+      describe '.from_urls' do
+        it 'stores the given URLs for later use' do
+          platform = described_class.from_urls(
+            'https://lms.example.com',
+            jwks: '/custom/jwks',
+            auth_redirect: '/custom/auth',
+            grant: '/custom/grant'
+          )
+
+          expect(platform.options).to eq(
+            base_url: 'https://lms.example.com',
+            jwks_url: '/custom/jwks',
+            auth_redirect_url: '/custom/auth',
+            grant_url: '/custom/grant'
+          )
+        end
+
+        it 'derives platform_uri from base_url' do
+          platform = described_class.from_urls('https://lms.example.com')
+
+          expect(platform.platform_uri).to eq('https://lms.example.com')
+        end
+
+        it 'derives jwks_url from base_url, using the default path when none given' do
+          platform = described_class.from_urls('https://lms.example.com')
+
+          expect(platform.jwks_url).to eq('https://lms.example.com/api/lti/security/jwks')
+        end
+
+        it 'derives jwks_url from a custom path when given' do
+          platform = described_class.from_urls('https://lms.example.com', jwks: '/custom/jwks')
+
+          expect(platform.jwks_url).to eq('https://lms.example.com/custom/jwks')
+        end
+
+        it 'derives authentication_redirect_url from base_url, using the default path when none given' do
+          platform = described_class.from_urls('https://lms.example.com')
+
+          expect(platform.authentication_redirect_url).to eq('https://lms.example.com/api/lti/authorize_redirect')
+        end
+
+        it 'derives grant_url from base_url, using the default path when none given' do
+          platform = described_class.from_urls('https://lms.example.com')
+
+          expect(platform.grant_url).to eq('https://lms.example.com/login/oauth2/token')
+        end
+      end
+    end
+
+    describe '#serialize / .from_serialized' do
+      it 'round-trips a Canvas platform' do
+        platform = Platform::Canvas.new(iss: 'https://canvas.instructure.com')
+        restored = Platform.from_serialized(platform.serialize)
+
+        expect(restored).to be_a(Platform::Canvas)
+        expect(restored.platform_uri).to eq(platform.platform_uri)
+        expect(restored.jwks_url).to eq(platform.jwks_url)
+      end
+
+      it 'round-trips a Generic platform' do
+        platform = Platform::Generic.from_urls('https://lms.example.com', jwks: '/custom/jwks')
+        restored = Platform.from_serialized(platform.serialize)
+
+        expect(restored).to be_a(Platform::Generic)
+        expect(restored.platform_uri).to eq(platform.platform_uri)
+        expect(restored.jwks_url).to eq(platform.jwks_url)
+      end
+    end
+  end
+end

data/spec/models/panda_pal/session_spec.rb

@@ -5,5 +5,151 @@ module PandaPal
     it 'is initialized with a session_secret' do
       expect(PandaPal::Session.new.session_secret).to_not be_nil
     end
+
+    describe '.for_panda_token' do
+      it 'returns nil for a nil token' do
+        expect(Session.for_panda_token(nil)).to be_nil
+      end
+
+      it 'returns nil for an empty token' do
+        expect(Session.for_panda_token('')).to be_nil
+      end
+
+      context 'with a KEY-type token' do
+        let(:session) { create(:panda_pal_session) }
+
+        it 'returns the matching session record' do
+          found = Session.for_panda_token(session.session_key, enforce_tenant: false)
+          expect(found).to eq(session)
+        end
+
+        it 'raises SessionNonceMismatch when the secret in the signature is wrong' do
+          header, _sig = session.session_key.split('.')
+          tampered_token = "#{header}.not-the-real-secret"
+
+          expect {
+            Session.for_panda_token(tampered_token, enforce_tenant: false)
+          }.to raise_error(Session::SessionNonceMismatch)
+        end
+
+        it 'raises SessionNonceMismatch when the payload session id does not match the found record' do
+          other_session = create(:panda_pal_session)
+
+          header, sig = session.session_key.split('.')
+          payload = JSON.parse(Base64.urlsafe_decode64(header))
+          payload['s'] = other_session.id
+          tampered_header = Base64.urlsafe_encode64(payload.to_json)
+          tampered_token = "#{tampered_header}.#{sig}"
+
+          expect {
+            Session.for_panda_token(tampered_token, enforce_tenant: false)
+          }.to raise_error(Session::SessionNonceMismatch)
+        end
+      end
+    end
+
+    describe '#sign_value / #validate_signature' do
+      it 'produces a base64-encoded HMAC-SHA256 digest without relying on OpenSSL::HMAC.base64digest' do
+        session = build(:panda_pal_session)
+
+        # OpenSSL::HMAC.base64digest doesn't exist at all on some Rubies' bundled
+        # openssl gem (that's the bug this test guards against) -- only assert the
+        # negative expectation where the method exists to negate; the correctness
+        # check below is what actually proves sign_value doesn't depend on it.
+        expect(OpenSSL::HMAC).not_to receive(:base64digest) if OpenSSL::HMAC.respond_to?(:base64digest)
+        signature = session.sign_value('some-data-to-sign')
+
+        expected = Base64.strict_encode64(OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), session.session_secret, 'some-data-to-sign'))
+        expect(signature).to eq(expected)
+      end
+
+      it 'validates a signature produced by the same session' do
+        session = build(:panda_pal_session)
+        signature = session.sign_value('some-data-to-sign')
+
+        expect(session.validate_signature('some-data-to-sign', signature)).to be true
+      end
+
+      it 'does not validate a signature produced by a different session' do
+        session = build(:panda_pal_session)
+        other_session = build(:panda_pal_session)
+
+        signature_from_other = other_session.sign_value('some-data-to-sign')
+
+        expect(session.validate_signature('some-data-to-sign', signature_from_other)).to be false
+      end
+    end
+
+    describe '.extract_panda_token' do
+      it 'extracts the token from the X-Panda-Token header (HTTP_ form)' do
+        request = double('request', headers: { 'HTTP_X_PANDA_TOKEN' => 'header.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('header.token')
+      end
+
+      it 'extracts the token from the X-Panda-Token header (raw form)' do
+        request = double('request', headers: { 'X-Panda-Token' => 'header.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('header.token')
+      end
+
+      it 'falls back to request.env when the request does not respond to headers' do
+        request = double('request', env: { 'HTTP_X_PANDA_TOKEN' => 'env.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('env.token')
+      end
+
+      it 'extracts the token from an "Authorization: Bearer panda:<token>" header' do
+        request = double('request', headers: { 'HTTP_AUTHORIZATION' => 'Bearer panda:bearer.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('bearer.token')
+      end
+
+      it 'extracts the token from the raw Authorization header key' do
+        request = double('request', headers: { 'Authorization' => 'Bearer panda:bearer.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('bearer.token')
+      end
+
+      it 'extracts the token from the legacy "Authorization: token=<token>" header format' do
+        request = double('request', headers: { 'HTTP_AUTHORIZATION' => 'token=legacy.token' })
+        expect(Session.extract_panda_token(request, {})).to eq('legacy.token')
+      end
+
+      it 'extracts the token from params["panda_token"]' do
+        request = double('request', headers: {})
+        expect(Session.extract_panda_token(request, { 'panda_token' => 'params.token' })).to eq('params.token')
+      end
+
+      it 'extracts the token from the legacy params["session_token"]' do
+        request = double('request', headers: {})
+        expect(Session.extract_panda_token(request, { 'session_token' => 'legacy.session.token' })).to eq('legacy.session.token')
+      end
+
+      it 'extracts the token from the legacy params["session_key"]' do
+        request = double('request', headers: {})
+        expect(Session.extract_panda_token(request, { 'session_key' => 'legacy.session.key.token' })).to eq('legacy.session.key.token')
+      end
+
+      it 'returns nil when nothing is present' do
+        request = double('request', headers: {})
+        expect(Session.extract_panda_token(request, {})).to be_nil
+      end
+    end
+
+    describe '.format_url_for_signing' do
+      it 'strips panda_token, session_key, and session_token but keeps other params' do
+        url = 'https://example.com/some/path?panda_token=tok&foo=bar&session_key=abc&baz=qux&session_token=def'
+
+        expect(Session.format_url_for_signing(url)).to eq('/some/path?foo=bar&baz=qux')
+      end
+
+      it 'accepts a URI object directly' do
+        uri = URI.parse('https://example.com/some/path?panda_token=tok&foo=bar')
+
+        expect(Session.format_url_for_signing(uri)).to eq('/some/path?foo=bar')
+      end
+
+      it 'produces an empty query string when no params remain' do
+        url = 'https://example.com/some/path?panda_token=tok'
+
+        expect(Session.format_url_for_signing(url)).to eq('/some/path?')
+      end
+    end
   end
 end

data/spec/spec_helper.rb

@@ -1,5 +1,12 @@
 # ENV["RAILS_ENV"] ||= 'test'
 
+if ENV['COVERAGE']
+  require 'simplecov'
+  SimpleCov.start do
+    add_filter '/spec/'
+  end
+end
+
 require 'bundler'
 Bundler.require :default, :development
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 5.16.20
+  version: 5.16.21
 platform: ruby
 authors:
 - Instructure CustomDev
@@ -55,30 +55,30 @@ dependencies:
   name: browser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.5.0
+        version: '5.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.5.0
+        version: '5.3'
 - !ruby/object:Gem::Dependency
   name: attr_encrypted
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: '4.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: '4.2'
 - !ruby/object:Gem::Dependency
   name: secure_headers
   requirement: !ruby/object:Gem::Requirement
@@ -197,6 +197,8 @@ files:
 - lib/tasks/panda_pal_tasks.rake
 - panda_pal.gemspec
 - spec/controllers/panda_pal/api_call_controller_spec.rb
+- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
+- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
 - spec/core/apartment_multidb_spec.rb
 - spec/factories/panda_pal_organizations.rb
 - spec/factories/panda_pal_sessions.rb
@@ -204,10 +206,13 @@ files:
 - spec/internal/config/routes.rb
 - spec/internal/config/storage.yml
 - spec/internal/db/schema.rb
+- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
+- spec/lib/panda_pal/helpers/secure_headers_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
 - spec/models/panda_pal/organization/settings_validation_spec.rb
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
 - spec/models/panda_pal/organization_spec.rb
+- spec/models/panda_pal/platform_spec.rb
 - spec/models/panda_pal/session_spec.rb
 - spec/spec_helper.rb
 homepage: http://instructure.com
@@ -233,6 +238,8 @@ specification_version: 4
 summary: LTI mountable engine
 test_files:
 - spec/controllers/panda_pal/api_call_controller_spec.rb
+- spec/controllers/panda_pal/lti_v1_p0_controller_spec.rb
+- spec/controllers/panda_pal/lti_v1_p3_controller_spec.rb
 - spec/core/apartment_multidb_spec.rb
 - spec/factories/panda_pal_organizations.rb
 - spec/factories/panda_pal_sessions.rb
@@ -240,9 +247,12 @@ test_files:
 - spec/internal/config/routes.rb
 - spec/internal/config/storage.yml
 - spec/internal/db/schema.rb
+- spec/jobs/panda_pal/jobs/grade_passback_job_spec.rb
+- spec/lib/panda_pal/helpers/secure_headers_spec.rb
 - spec/models/panda_pal/api_call_spec.rb
 - spec/models/panda_pal/organization/settings_validation_spec.rb
 - spec/models/panda_pal/organization/task_scheduling_spec.rb
 - spec/models/panda_pal/organization_spec.rb
+- spec/models/panda_pal/platform_spec.rb
 - spec/models/panda_pal/session_spec.rb
 - spec/spec_helper.rb