Back-end: "allow includes" checkbox

The "allow_includes" field on the developer
key is used to control what access tokens
can use "include" parameters when making
API requests.

refs PLAT-5152
flag = developer_key_support_includes

Test Plan:
Verify you can set the "allow_includes" field
when creating a new developer key

Verify you can update the "allow_includes" field
when editing an existing developer key

Change-Id: Ibcfb7a2cdd06793483421b1ad6a8c0a8d7b99ed6
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/222617
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
Reviewed-by: Clint Furse <cfurse@instructure.com>
QA-Review: Clint Furse <cfurse@instructure.com>

app/controllers/developer_keys_controller.rb

@@ -139,6 +139,7 @@ class DeveloperKeysController < ApplicationController
       :visible,
       :test_cluster_only,
       :require_scopes,
+      :allow_includes,
       scopes: []
     )
   end

app/jsx/developer_keys/Scopes.js

@@ -129,7 +129,13 @@ export default class Scopes extends React.Component {
                 label={
                   <>
                     <Text>{I18n.t('Allow Include Parameters ')}</Text>
-                    <Tooltip tip="description" on={['hover', 'focus']} variant="inverse">
+                    <Tooltip
+                      tip={I18n.t(
+                        'Permit usage of all “includes” parameters for this developer key. "Includes" parameters may grant access to additional data not included in the scopes selected below.'
+                      )}
+                      on={['hover', 'focus']}
+                      variant="inverse"
+                    >
                       <span tabIndex="0">
                         <IconInfoLine />
                       </span>

lib/api/v1/developer_key.rb

@@ -50,6 +50,7 @@ module Api::V1::DeveloperKey
         hash['vendor_code'] = key.vendor_code
         hash['public_jwk'] = key.public_jwk
         hash['public_jwk_url'] = key.public_jwk_url
+        hash['allow_includes'] = key.allow_includes
       end
 
       if account_binding.present?

spec/apis/v1/developer_keys_spec.rb

@@ -90,6 +90,16 @@ describe DeveloperKeysController, type: :request do
       expect(json_parse.first.keys).to include 'tool_configuration'
     end
 
+    it 'should include "allow_includes"' do
+      a = Account.create!
+      allow_any_instance_of(DeveloperKeysController).to receive(:context_is_domain_root_account?).and_return(true)
+      user_session(account_admin_user(account: a))
+      d = DeveloperKey.create!(account: a)
+      d.update! visible: true
+      get "/api/v1/accounts/#{a.id}/developer_keys"
+      expect(json_parse.first.keys).to include 'allow_includes'
+    end
+
     it 'does not include `test_cluster_only` by default' do
       admin_session
       key = DeveloperKey.create!

spec/controllers/developer_keys_controller_spec.rb

@@ -196,6 +196,11 @@ describe DeveloperKeysController do
           user_session(@admin)
         end
 
+        it 'allows setting "allow_includes"' do
+          post 'create', params: { account_id: root_account.id, developer_key: { scopes: valid_scopes, allow_includes: true } }
+          expect(DeveloperKey.find(json_parse['id']).allow_includes).to eq true
+        end
+
         it 'allows setting scopes' do
           post 'create', params: { account_id: root_account.id, developer_key: { scopes: valid_scopes } }
           expect(DeveloperKey.find(json_parse['id']).scopes).to match_array valid_scopes
@@ -248,6 +253,11 @@ describe DeveloperKeysController do
           user_session(@admin)
         end
 
+        it 'allows setting "allow_includes"' do
+          put 'update', params: { id: developer_key.id, developer_key: { scopes: valid_scopes, allow_includes: false } }
+          expect(developer_key.reload.allow_includes).to eq false
+        end
+
         it 'allows setting scopes for site admin keys' do
           put 'update', params: { id: site_admin_key.id, developer_key: { scopes: valid_scopes } }
           expect(site_admin_key.reload.scopes).to match_array valid_scopes