canvas-lms/spec/lti2_spec_helper.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

213 lines
7.2 KiB
Ruby
Raw Normal View History

# frozen_string_literal: true
#
# Copyright (C) 2017 - present Instructure, Inc.
#
# This file is part of Canvas.
#
# Canvas is free software: you can redistribute it and/or modify it under
# the terms of the GNU Affero General Public License as published by the Free
# Software Foundation, version 3 of the License.
#
# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along
# with this program. If not, see <http://www.gnu.org/licenses/>.
RSpec.shared_context "lti2_spec_helper", shared_context: :metadata do
LTI2 API webhook subscription service Fixes: PLAT-2129 PLAT-2126 Test Plan: - Verify you can create and retrieve a TCP with the new subscription service and capabilities. - Install an LTI2 tool using the split secret capability. The tool's security contract should use the new webhook service. Example security contract: "tp_half_shared_secret"=> "873f5...", "tool_service"=> [{"@type"=>"RestServiceProfile", "service"=>"vnd.Canvas.webhooksSubscription", "action"=>["GET", "POST"]}]} - Do a POST request to /api/lti/subscriptions with the following body: { "subscription":{ "EventTypes":[ "submission_created" ], "ContextType":"course", "ContextId":<valid course id here>, "Format":"live-event", "TransportType":"sqs", "TransportMetadata":{ "Url":"http://sqs.docker" } } } - Verify a 401 is returned - Using https://docs.google.com/document/d /12x6Peif-I-0zvl2uMv2JVbQdZumGGqMtspWKYTqlL9o/edit attempt to create each subscription type (in bold) and verify 401s are returned in each case. - Using the same document, verify that adding one of the capabilities listed under a subscription types allows you to create the subscription - Verify that using the vnd.instructure.webhooks.root_account.all capability allows you to create any subscription. - Install an LTI2 tool in a course - Attempt to create a subscription in another course and verify a 401 is given. Change-Id: I322e4bb2c49209afdc6f0a3c3a8b5c73e339996e Reviewed-on: https://gerrit.instructure.com/102272 Tested-by: Jenkins QA-Review: August Thornton <august@instructure.com> Reviewed-by: Andrew Butterfield <abutterfield@instructure.com> Product-Review: Weston Dransfield <wdransfield@instructure.com>
2017-02-14 23:55:06 +08:00
let(:account) { Account.create! }
let(:course) do
course_with_student(account: account, active_all: true)
@course
end
let(:student) { course.student_enrollments.first.user }
let(:vendor_code) { "com.instructure.test" }
let(:developer_key) { DeveloperKey.create!(redirect_uri: "http://www.example.com/redirect", vendor_code: vendor_code) }
let(:product_family) do
Lti::ProductFamily.create!(
vendor_code: vendor_code,
product_code: "abc",
vendor_name: "acme",
root_account: account,
developer_key: developer_key
)
end
Distinguish course/account tool installs in ACTL The AssignmentConfigurationToolLookup (ACTL) represents that a given assignment is connected with a given plagiarism detection (LTI2) tool. This is a soft link, not a direct "tool_proxy_id" link to the tool installation, though, since we can uninstall and reinstall tools and we want those connections (actually LESS subscriptions) to be reestablished. We used to figure out that a ACTL belongs to a give tool by matching up product and vendor codes; but if the user installs the tool in both a Course context and an Account context, we can get confused, and one tool from either context can delete the subscriptions created with the tool in the other context. The solution is to store the context_type (Course or Account) in the ACTL when setting up an assignment with a plagiarism detection tool. Test plan: - instrument the locations in the canvas code where a LESS subscription is created and destroyed. You can comment out the calls and replace with "puts" statements in lib/lti/assignment_subscriptions_helper.rb: * replace `destroy_subscription` to not send to LESS, but log (append to a file is easiest to see) with the ID * replace `create_subscription` - make it log (append to a file) and return a fake id like `rand(100000).to_s * run both canvas web and jobs - install a locally-running test tool (e.g. web.lti-originality-report-example.docker:3000/register) in a course context and add an assignment that uses the tool. (note: sometimes when adding a tool it didn't show up in the new assignment dropdown. restarting canvas may help) - Check subscription id: `AssignmentConfigurationToolLookup.where(assignment_id: a_id` The ACTL should also have a context_type of "Course" - install the test tool in a account context. check (by looking at ACTL) that the subscription ID did not change, and that no subscriptions were created or destroyed. - delete the account-level test tool. observe that nothing changed. delete the course-level test tool, observe that the subscriptions have been deleted (looking at the logging you added). - you can do other combinations like creating assignments with an account-level tool. - Test "Blueprint course" syncing still works by creating a blueprint course, adding a tool and assignment with tool, making copies of the course, and syncing the copies. Check that there is still only one copy of the ACTL per course. Fixes PLAT-5023 Change-Id: I6ded9ab91e223fc1cf6a9b7ed7f0df649823c95d Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215171 Tested-by: Jenkins Reviewed-by: Weston Dransfield <wdransfield@instructure.com> QA-Review: Weston Dransfield <wdransfield@instructure.com> Product-Review: Jesse Poulos <jpoulos@instructure.com>
2019-10-29 07:51:16 +08:00
let(:tool_proxy_context) { account }
let(:tool_proxy) { create_tool_proxy(tool_proxy_context) }
def create_tool_proxy(context, overrides = {})
tp = Lti::ToolProxy.create!(
Distinguish course/account tool installs in ACTL The AssignmentConfigurationToolLookup (ACTL) represents that a given assignment is connected with a given plagiarism detection (LTI2) tool. This is a soft link, not a direct "tool_proxy_id" link to the tool installation, though, since we can uninstall and reinstall tools and we want those connections (actually LESS subscriptions) to be reestablished. We used to figure out that a ACTL belongs to a give tool by matching up product and vendor codes; but if the user installs the tool in both a Course context and an Account context, we can get confused, and one tool from either context can delete the subscriptions created with the tool in the other context. The solution is to store the context_type (Course or Account) in the ACTL when setting up an assignment with a plagiarism detection tool. Test plan: - instrument the locations in the canvas code where a LESS subscription is created and destroyed. You can comment out the calls and replace with "puts" statements in lib/lti/assignment_subscriptions_helper.rb: * replace `destroy_subscription` to not send to LESS, but log (append to a file is easiest to see) with the ID * replace `create_subscription` - make it log (append to a file) and return a fake id like `rand(100000).to_s * run both canvas web and jobs - install a locally-running test tool (e.g. web.lti-originality-report-example.docker:3000/register) in a course context and add an assignment that uses the tool. (note: sometimes when adding a tool it didn't show up in the new assignment dropdown. restarting canvas may help) - Check subscription id: `AssignmentConfigurationToolLookup.where(assignment_id: a_id` The ACTL should also have a context_type of "Course" - install the test tool in a account context. check (by looking at ACTL) that the subscription ID did not change, and that no subscriptions were created or destroyed. - delete the account-level test tool. observe that nothing changed. delete the course-level test tool, observe that the subscriptions have been deleted (looking at the logging you added). - you can do other combinations like creating assignments with an account-level tool. - Test "Blueprint course" syncing still works by creating a blueprint course, adding a tool and assignment with tool, making copies of the course, and syncing the copies. Check that there is still only one copy of the ACTL per course. Fixes PLAT-5023 Change-Id: I6ded9ab91e223fc1cf6a9b7ed7f0df649823c95d Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215171 Tested-by: Jenkins Reviewed-by: Weston Dransfield <wdransfield@instructure.com> QA-Review: Weston Dransfield <wdransfield@instructure.com> Product-Review: Jesse Poulos <jpoulos@instructure.com>
2019-10-29 07:51:16 +08:00
context: context,
guid: SecureRandom.uuid,
shared_secret: "abc",
product_family: product_family,
product_version: "1",
workflow_state: "active",
raw_data: {
"enabled_capability" => overrides[:enabled_capability] || ["Security.splitSecret"],
"security_contract" => security_contract,
"tool_profile" => {
"lti_version" => "LTI-2p0",
"product_instance" => {
"guid" => "be42ae52-23fe-48f5-a783-40ecc7ef6d5c",
"product_info" => {
"product_version" => "1.0",
"product_family" => {
"code" => "abc",
"vendor" => {
"code" => "123",
"vendor_name" => {
"default_value" => "acme"
},
"description" => {
"default_value" => "example vendor"
}
}
},
"description" => {
"default_value" => "example product"
},
"product_name" => {
"default_value" => "learn abc's"
}
}
},
"base_url_choice" => [
{
"default_base_url" => "https://www.samplelaunch.com",
"selector" => {
"applies_to" => [
"MessageHandler"
]
}
}
],
"resource_handler" => [
{
"resource_type" => {
"code" => "code"
},
"resource_name" => {
"default_value" => "resource name",
"key" => ""
},
"message" => [
{
"message_type" => "message_type",
"path" => "https://www.samplelaunch.com/blti"
}
]
},
],
"service_offered" => []
}
},
lti_version: "1",
subscription_id: overrides[:add_subscription_id] && SecureRandom.uuid
)
Distinguish course/account tool installs in ACTL The AssignmentConfigurationToolLookup (ACTL) represents that a given assignment is connected with a given plagiarism detection (LTI2) tool. This is a soft link, not a direct "tool_proxy_id" link to the tool installation, though, since we can uninstall and reinstall tools and we want those connections (actually LESS subscriptions) to be reestablished. We used to figure out that a ACTL belongs to a give tool by matching up product and vendor codes; but if the user installs the tool in both a Course context and an Account context, we can get confused, and one tool from either context can delete the subscriptions created with the tool in the other context. The solution is to store the context_type (Course or Account) in the ACTL when setting up an assignment with a plagiarism detection tool. Test plan: - instrument the locations in the canvas code where a LESS subscription is created and destroyed. You can comment out the calls and replace with "puts" statements in lib/lti/assignment_subscriptions_helper.rb: * replace `destroy_subscription` to not send to LESS, but log (append to a file is easiest to see) with the ID * replace `create_subscription` - make it log (append to a file) and return a fake id like `rand(100000).to_s * run both canvas web and jobs - install a locally-running test tool (e.g. web.lti-originality-report-example.docker:3000/register) in a course context and add an assignment that uses the tool. (note: sometimes when adding a tool it didn't show up in the new assignment dropdown. restarting canvas may help) - Check subscription id: `AssignmentConfigurationToolLookup.where(assignment_id: a_id` The ACTL should also have a context_type of "Course" - install the test tool in a account context. check (by looking at ACTL) that the subscription ID did not change, and that no subscriptions were created or destroyed. - delete the account-level test tool. observe that nothing changed. delete the course-level test tool, observe that the subscriptions have been deleted (looking at the logging you added). - you can do other combinations like creating assignments with an account-level tool. - Test "Blueprint course" syncing still works by creating a blueprint course, adding a tool and assignment with tool, making copies of the course, and syncing the copies. Check that there is still only one copy of the ACTL per course. Fixes PLAT-5023 Change-Id: I6ded9ab91e223fc1cf6a9b7ed7f0df649823c95d Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215171 Tested-by: Jenkins Reviewed-by: Weston Dransfield <wdransfield@instructure.com> QA-Review: Weston Dransfield <wdransfield@instructure.com> Product-Review: Jesse Poulos <jpoulos@instructure.com>
2019-10-29 07:51:16 +08:00
Lti::ToolProxyBinding.where(context_id: context.id, context_type: context.class.to_s,
tool_proxy_id: tp).first_or_create!
tp
end
Distinguish course/account tool installs in ACTL The AssignmentConfigurationToolLookup (ACTL) represents that a given assignment is connected with a given plagiarism detection (LTI2) tool. This is a soft link, not a direct "tool_proxy_id" link to the tool installation, though, since we can uninstall and reinstall tools and we want those connections (actually LESS subscriptions) to be reestablished. We used to figure out that a ACTL belongs to a give tool by matching up product and vendor codes; but if the user installs the tool in both a Course context and an Account context, we can get confused, and one tool from either context can delete the subscriptions created with the tool in the other context. The solution is to store the context_type (Course or Account) in the ACTL when setting up an assignment with a plagiarism detection tool. Test plan: - instrument the locations in the canvas code where a LESS subscription is created and destroyed. You can comment out the calls and replace with "puts" statements in lib/lti/assignment_subscriptions_helper.rb: * replace `destroy_subscription` to not send to LESS, but log (append to a file is easiest to see) with the ID * replace `create_subscription` - make it log (append to a file) and return a fake id like `rand(100000).to_s * run both canvas web and jobs - install a locally-running test tool (e.g. web.lti-originality-report-example.docker:3000/register) in a course context and add an assignment that uses the tool. (note: sometimes when adding a tool it didn't show up in the new assignment dropdown. restarting canvas may help) - Check subscription id: `AssignmentConfigurationToolLookup.where(assignment_id: a_id` The ACTL should also have a context_type of "Course" - install the test tool in a account context. check (by looking at ACTL) that the subscription ID did not change, and that no subscriptions were created or destroyed. - delete the account-level test tool. observe that nothing changed. delete the course-level test tool, observe that the subscriptions have been deleted (looking at the logging you added). - you can do other combinations like creating assignments with an account-level tool. - Test "Blueprint course" syncing still works by creating a blueprint course, adding a tool and assignment with tool, making copies of the course, and syncing the copies. Check that there is still only one copy of the ACTL per course. Fixes PLAT-5023 Change-Id: I6ded9ab91e223fc1cf6a9b7ed7f0df649823c95d Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215171 Tested-by: Jenkins Reviewed-by: Weston Dransfield <wdransfield@instructure.com> QA-Review: Weston Dransfield <wdransfield@instructure.com> Product-Review: Jesse Poulos <jpoulos@instructure.com>
2019-10-29 07:51:16 +08:00
let(:resource_handler) do
Lti::ResourceHandler.create!(
resource_type_code: "code",
name: "resource name",
tool_proxy: tool_proxy
)
end
let(:message_handler) do
Lti::MessageHandler.create!(
message_type: "basic-lti-launch-request",
launch_path: "https://www.samplelaunch.com/blti",
resource_handler: resource_handler,
tool_proxy: tool_proxy
)
end
Distinguish course/account tool installs in ACTL The AssignmentConfigurationToolLookup (ACTL) represents that a given assignment is connected with a given plagiarism detection (LTI2) tool. This is a soft link, not a direct "tool_proxy_id" link to the tool installation, though, since we can uninstall and reinstall tools and we want those connections (actually LESS subscriptions) to be reestablished. We used to figure out that a ACTL belongs to a give tool by matching up product and vendor codes; but if the user installs the tool in both a Course context and an Account context, we can get confused, and one tool from either context can delete the subscriptions created with the tool in the other context. The solution is to store the context_type (Course or Account) in the ACTL when setting up an assignment with a plagiarism detection tool. Test plan: - instrument the locations in the canvas code where a LESS subscription is created and destroyed. You can comment out the calls and replace with "puts" statements in lib/lti/assignment_subscriptions_helper.rb: * replace `destroy_subscription` to not send to LESS, but log (append to a file is easiest to see) with the ID * replace `create_subscription` - make it log (append to a file) and return a fake id like `rand(100000).to_s * run both canvas web and jobs - install a locally-running test tool (e.g. web.lti-originality-report-example.docker:3000/register) in a course context and add an assignment that uses the tool. (note: sometimes when adding a tool it didn't show up in the new assignment dropdown. restarting canvas may help) - Check subscription id: `AssignmentConfigurationToolLookup.where(assignment_id: a_id` The ACTL should also have a context_type of "Course" - install the test tool in a account context. check (by looking at ACTL) that the subscription ID did not change, and that no subscriptions were created or destroyed. - delete the account-level test tool. observe that nothing changed. delete the course-level test tool, observe that the subscriptions have been deleted (looking at the logging you added). - you can do other combinations like creating assignments with an account-level tool. - Test "Blueprint course" syncing still works by creating a blueprint course, adding a tool and assignment with tool, making copies of the course, and syncing the copies. Check that there is still only one copy of the ACTL per course. Fixes PLAT-5023 Change-Id: I6ded9ab91e223fc1cf6a9b7ed7f0df649823c95d Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215171 Tested-by: Jenkins Reviewed-by: Weston Dransfield <wdransfield@instructure.com> QA-Review: Weston Dransfield <wdransfield@instructure.com> Product-Review: Jesse Poulos <jpoulos@instructure.com>
2019-10-29 07:51:16 +08:00
let(:tool_proxy_binding) do
Lti::ToolProxyBinding.where(context_id: tool_proxy_context, context_type: tool_proxy_context.class.to_s,
tool_proxy_id: tool_proxy).first_or_create!
Distinguish course/account tool installs in ACTL The AssignmentConfigurationToolLookup (ACTL) represents that a given assignment is connected with a given plagiarism detection (LTI2) tool. This is a soft link, not a direct "tool_proxy_id" link to the tool installation, though, since we can uninstall and reinstall tools and we want those connections (actually LESS subscriptions) to be reestablished. We used to figure out that a ACTL belongs to a give tool by matching up product and vendor codes; but if the user installs the tool in both a Course context and an Account context, we can get confused, and one tool from either context can delete the subscriptions created with the tool in the other context. The solution is to store the context_type (Course or Account) in the ACTL when setting up an assignment with a plagiarism detection tool. Test plan: - instrument the locations in the canvas code where a LESS subscription is created and destroyed. You can comment out the calls and replace with "puts" statements in lib/lti/assignment_subscriptions_helper.rb: * replace `destroy_subscription` to not send to LESS, but log (append to a file is easiest to see) with the ID * replace `create_subscription` - make it log (append to a file) and return a fake id like `rand(100000).to_s * run both canvas web and jobs - install a locally-running test tool (e.g. web.lti-originality-report-example.docker:3000/register) in a course context and add an assignment that uses the tool. (note: sometimes when adding a tool it didn't show up in the new assignment dropdown. restarting canvas may help) - Check subscription id: `AssignmentConfigurationToolLookup.where(assignment_id: a_id` The ACTL should also have a context_type of "Course" - install the test tool in a account context. check (by looking at ACTL) that the subscription ID did not change, and that no subscriptions were created or destroyed. - delete the account-level test tool. observe that nothing changed. delete the course-level test tool, observe that the subscriptions have been deleted (looking at the logging you added). - you can do other combinations like creating assignments with an account-level tool. - Test "Blueprint course" syncing still works by creating a blueprint course, adding a tool and assignment with tool, making copies of the course, and syncing the copies. Check that there is still only one copy of the ACTL per course. Fixes PLAT-5023 Change-Id: I6ded9ab91e223fc1cf6a9b7ed7f0df649823c95d Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215171 Tested-by: Jenkins Reviewed-by: Weston Dransfield <wdransfield@instructure.com> QA-Review: Weston Dransfield <wdransfield@instructure.com> Product-Review: Jesse Poulos <jpoulos@instructure.com>
2019-10-29 07:51:16 +08:00
end
let(:tool_profile) do
{
"lti_version" => "LTI-2p0", "product_instance" => {
"guid" => "be42ae52-23fe-48f5-a783-40ecc7ef6d5c", "product_info" => {
"product_version" => "1.0", "product_family" => {
"code" => "similarity detection reference tool", "vendor" => {
"code" => "Instructure.com", "vendor_name" => {
"default_value" => "Instructure"
}, "description" => {
"default_value" => "Canvas Learning Management System"
}
}
}, "description" => {
"default_value" => "LTI 2.1 tool provider reference implementation"
}, "product_name" => {
"default_value" => "similarity detection reference tool"
}
}
}, "base_url_choice" => [{
"default_base_url" => "http://originality.docker", "selector" => {
"applies_to" => ["MessageHandler"]
}
}], "resource_handler" => [{
"resource_type" => {
"code" => "sumbissions"
}, "resource_name" => {
"default_value" => "Similarity Detection Tool", "key" => ""
}, "message" => [{
"message_type" => "basic-lti-launch-request",
"path" => "/submission/index",
"enabled_capability" => ["Canvas.placements.accountNavigation", "Canvas.placements.courseNavigation"],
"parameter" => []
}]
}, {
"resource_type" => {
"code" => "placements"
}, "resource_name" => {
"default_value" => "Similarity Detection Tool", "key" => ""
}, "message" => [{
"message_type" => "basic-lti-launch-request",
"path" => "/assignments/configure",
"enabled_capability" => ["Canvas.placements.similarityDetection"],
"parameter" => []
}]
}, {
"resource_type" => {
"code" => "originality_reports"
}, "resource_name" => {
"default_value" => "Similarity Detection Tool", "key" => ""
}, "message" => [{
"message_type" => "basic-lti-launch-request",
"path" => "/originality_report",
"enabled_capability" => [],
"parameter" => []
}]
}], "service_offered" => [{
"endpoint" => "http://originality.docker/event/submission",
"action" => ["POST"],
"@id" => "http://originality.docker/lti/v2/services#vnd.Canvas.SubmissionEvent",
"@type" => "RestService"
}]
}
end
let(:security_contract) do
{
"tp_half_shared_secret" => "shared-secret",
"tool_service" => [
{ "service" => "vnd.Canvas.submission",
"action" => ["GET"],
"@type" => "RestServiceProfile" },
{ "service" => "vnd.Canvas.OriginalityReport",
"action" => %w[GET POST PUT],
"@type" => "RestServiceProfile" }
]
}
end
end