canvas-lms/lib/services/live_events_subscription_se...

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

129 lines
4.5 KiB
Ruby
Raw Normal View History

# frozen_string_literal: true
#
# Copyright (C) 2017 - present Instructure, Inc.
#
# This file is part of Canvas.
#
# Canvas is free software: you can redistribute it and/or modify it under
# the terms of the GNU Affero General Public License as published by the Free
# Software Foundation, version 3 of the License.
#
# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along
# with this program. If not, see <http://www.gnu.org/licenses/>.
module Services
class LiveEventsSubscriptionService
class << self
def available?
settings.present? && settings["app-host"].present?
end
def disabled?
settings&.[]("disabled")
end
def tool_proxy_subscription(tool_proxy, subscription_id)
show(tool_proxy_jwt_body(tool_proxy), subscription_id)
end
def tool_proxy_subscriptions(tool_proxy, optional_headers = {})
index(tool_proxy_jwt_body(tool_proxy), optional_headers)
end
def create_tool_proxy_subscription(tool_proxy, subscription)
Rails.logger.info do
"in: LiveEventsSubscriptionService::create_tool_proxy_subscription, " \
"tool_proxy_id: #{tool_proxy.id}, subscription: #{subscription}"
end
create(tool_proxy_jwt_body(tool_proxy), subscription)
end
def update_tool_proxy_subscription(tool_proxy, _subscription_id, subscription)
update(tool_proxy_jwt_body(tool_proxy), subscription)
end
def destroy_tool_proxy_subscription(tool_proxy, subscription_id)
Rails.logger.info do
"in: LiveEventsSubscriptionService::destroy_tool_proxy_subscription, " \
"tool_proxy_id: #{tool_proxy.id}, subscription_id: #{subscription_id}"
end
destroy(tool_proxy_jwt_body(tool_proxy), subscription_id)
end
def destroy_all_tool_proxy_subscriptions(tool_proxy)
options = { headers: headers(tool_proxy_jwt_body(tool_proxy)) }
request(:delete, "/api/subscriptions", options)
end
def create(jwt_body, subscription)
options = {
headers: headers(jwt_body, { "Content-Type" => "application/json" }),
body: subscription.to_json
}
request(:post, "/api/subscriptions", options)
end
def show(jwt_body, subscription_id)
options = { headers: headers(jwt_body) }
request(:get, "/api/subscriptions/#{subscription_id}", options)
end
def update(jwt_body, subscription)
options = {
headers: headers(jwt_body, { "Content-Type" => "application/json" }),
body: subscription.to_json
}
request(:put, "/api/subscriptions/#{subscription["Id"]}", options)
end
def destroy(jwt_body, subscription_id)
options = { headers: headers(jwt_body) }
request(:delete, "/api/subscriptions/#{subscription_id}", options)
end
def index(jwt_body, opts = {}, query: {})
options = { headers: headers(jwt_body, opts), query: }
request(:get, "/api/root_account_subscriptions", options)
end
def event_types_index(jwt_body, message_type, opts = {})
options = { headers: headers(jwt_body, opts) }
request(:get, "/api/event_types?message_type=#{message_type}", options)
end
private
def request(method, endpoint, options = {})
Canvas.timeout_protection("live-events-subscription-service-session", raise_on_timeout: true) do
HTTParty.send(method, "#{settings["app-host"]}#{endpoint}", options.merge(timeout: 10))
end
end
def headers(jwt_body, headers = {})
Add asymmetric encryption for service tokens refs FOO-2410 test plan: - in dynamic_settings.yml, add the following block: ``` store: canvas: services-jwt: # these are all the same JWK but with different kid # to generate a new key, run the following in a Canvas console: # # key = OpenSSL::PKey::RSA.generate(2048) # key.public_key.to_jwk(kid: Time.now.utc.iso8601).to_json jwk-past.json: "{\"kty\":\"RSA\",\"e\":\"AQAB\",\"n\":\"uX1MpfEMQCBUMcj0sBYI-iFaG5Nodp3C6OlN8uY60fa5zSBd83-iIL3n_qzZ8VCluuTLfB7rrV_tiX727XIEqQ\",\"kid\":\"2018-05-18T22:33:20Z_a\",\"d\":\"pYwR64x-LYFtA13iHIIeEvfPTws50ZutyGfpHN-kIZz3k-xVpun2Hgu0hVKZMxcZJ9DkG8UZPqD-zTDbCmCyLQ\",\"p\":\"6OQ2bi_oY5fE9KfQOcxkmNhxDnIKObKb6TVYqOOz2JM\",\"q\":\"y-UBef95njOrqMAxJH1QPds3ltYWr8QgGgccmcATH1M\",\"dp\":\"Ol_xkL7rZgNFt_lURRiJYpJmDDPjgkDVuafIeFTS4Ic\",\"dq\":\"RtzDY5wXr5TzrwWEztLCpYzfyAuF_PZj1cfs976apsM\",\"qi\":\"XA5wnwIrwe5MwXpaBijZsGhKJoypZProt47aVCtWtPE\"}" jwk-present.json: "{\"kty\":\"RSA\",\"e\":\"AQAB\",\"n\":\"uX1MpfEMQCBUMcj0sBYI-iFaG5Nodp3C6OlN8uY60fa5zSBd83-iIL3n_qzZ8VCluuTLfB7rrV_tiX727XIEqQ\",\"kid\":\"2018-06-18T22:33:20Z_b\",\"d\":\"pYwR64x-LYFtA13iHIIeEvfPTws50ZutyGfpHN-kIZz3k-xVpun2Hgu0hVKZMxcZJ9DkG8UZPqD-zTDbCmCyLQ\",\"p\":\"6OQ2bi_oY5fE9KfQOcxkmNhxDnIKObKb6TVYqOOz2JM\",\"q\":\"y-UBef95njOrqMAxJH1QPds3ltYWr8QgGgccmcATH1M\",\"dp\":\"Ol_xkL7rZgNFt_lURRiJYpJmDDPjgkDVuafIeFTS4Ic\",\"dq\":\"RtzDY5wXr5TzrwWEztLCpYzfyAuF_PZj1cfs976apsM\",\"qi\":\"XA5wnwIrwe5MwXpaBijZsGhKJoypZProt47aVCtWtPE\"}" jwk-future.json: "{\"kty\":\"RSA\",\"e\":\"AQAB\",\"n\":\"uX1MpfEMQCBUMcj0sBYI-iFaG5Nodp3C6OlN8uY60fa5zSBd83-iIL3n_qzZ8VCluuTLfB7rrV_tiX727XIEqQ\",\"kid\":\"2018-07-18T22:33:20Z_c\",\"d\":\"pYwR64x-LYFtA13iHIIeEvfPTws50ZutyGfpHN-kIZz3k-xVpun2Hgu0hVKZMxcZJ9DkG8UZPqD-zTDbCmCyLQ\",\"p\":\"6OQ2bi_oY5fE9KfQOcxkmNhxDnIKObKb6TVYqOOz2JM\",\"q\":\"y-UBef95njOrqMAxJH1QPds3ltYWr8QgGgccmcATH1M\",\"dp\":\"Ol_xkL7rZgNFt_lURRiJYpJmDDPjgkDVuafIeFTS4Ic\",\"dq\":\"RtzDY5wXr5TzrwWEztLCpYzfyAuF_PZj1cfs976apsM\",\"qi\":\"XA5wnwIrwe5MwXpaBijZsGhKJoypZProt47aVCtWtPE\"}" ``` - Ensure /internal/services/jwks loads correctly - In console, ensure `CanvasSecurity::ServicesJwt.decrypt(Base64.decode64(CanvasSecurity::ServicesJwt.for_user('localhost', User.first)))` and `CanvasSecurity::ServicesJwt.decrypt(Base64.decode64(CanvasSecurity::ServicesJwt.for_user('localhost', User.first, symmetric: true)))` both work and produce sensible looking output Change-Id: I13c6c35cc92ed12d03bf97e89e590614e11c6d47 Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/275160 QA-Review: August Thornton <august@instructure.com> Product-Review: August Thornton <august@instructure.com> Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com> Reviewed-by: Ethan Vizitei <evizitei@instructure.com> Reviewed-by: Evan Battaglia <ebattaglia@instructure.com>
2021-10-05 03:20:31 +08:00
token = CanvasSecurity::ServicesJwt.generate(jwt_body, symmetric: true)
headers["Authorization"] = "Bearer #{token}"
headers
end
def settings
DynamicSettings.find("live-events-subscription-service", default_ttl: 5.minutes)
end
def tool_proxy_jwt_body(tool_proxy, options = {})
options.merge({
sub: "ltiToolProxy:#{tool_proxy.guid}",
DeveloperKey: tool_proxy.product_family.developer_key.global_id.to_s,
RootAccountId: (tool_proxy.context.global_root_account_id || tool_proxy.context.global_id).to_s,
RootAccountUUID: tool_proxy.context.root_account.uuid
})
end
end
end
end