Commit Graph

587 Commits

Author SHA1 Message Date
Chrystal Langston 4ef2e9e2d4 Add context uuid to LOR updated and created live event data
This PS also adds LOR id to the live event.

refs OUT-6162
flag=none

test plan:
- tests are sufficient and Jenkins passes

Change-Id: I6a9b262c44566ac1b2b4f2c737f5f6f017ed4428
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/346494
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Dave Wenzlick <david.wenzlick@instructure.com>
QA-Review: Dave Wenzlick <david.wenzlick@instructure.com>
QA-Review: Chrystal Langston <chrystal.langston@instructure.com>
Product-Review: Kyle Rosenbaum <krosenbaum@instructure.com>
2024-05-14 17:18:54 +00:00
Jacob Windle 21d38868af Implement real-time discussion translation
test plan: Put translation AWS credentials into Canvas vault.
Create a test discussion in new discussions UI. Enable feature flag.
Click the kebab menu icon on discussion post page, click show translation.
Select a language from translation dropdown menu. Ensure loading icons and translations
are happening.

flag=translation
refs ADV-100

Change-Id: Id86f53184b31e504fe3736bab9e5b15b47a87e5d
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/346282
Reviewed-by: Jonathan Featherstone <jfeatherstone@instructure.com>
QA-Review: Jacob Windle <jacob.windle@instructure.com>
Product-Review: Jacob Windle <jacob.windle@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2024-05-03 20:03:44 +00:00
August Thornton a20c177e94 make canvas login attempts configurable per account
canvas login limits configurable at the institution level:
  • removed logic for max attemps by ip
  • consolidated to only one max attempts setting for any given
    root account
  • there is a global max attempts hard limit setting that can be set
    via the console
  • the default is 10 attempts, but can be set per institution
    to desired value

closes FOO-4206
flag = none

test plan:
* redis must be configured for the login registry to work
1. set up a new password policy via the console, e.g.
   a = Account.default
   a.settings[:password_policy] = { max_attempts: 1 }
   a.save!
2. login with a valid user and invalid password via Canvas auth
   (e.g. /login/canvas)
2. verify greater than max attempts (1 in this case) results in a
   lockout "Too many failed login attempts" within a 5 minute window

Change-Id: I6d66bc1cf8c935ed6cab3710dc3f8dc3c31bb4a2
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/345531
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Michael Hulse <michael.hulse@instructure.com>
Reviewed-by: Jason Perry <jason.perry@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: August Thornton <august@instructure.com>
2024-05-02 16:26:07 +00:00
Ricardo Oliveira c185928ff3 skip quizzes_next_export.json for NQ CC exports
closes QUIZ-13325
flag=new_quizzes_common_cartridge

test plan:
- Specs pass
- Create a course with at least one New Quiz
- Generate a content export for that course
- Verify the .zip file and that quizzes_next_export.json
is absent

Change-Id: Ie8d4b0a3ea87013004daacbb8cede9d1f9764817
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/343776
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jorge Arteaga <jorge.arteaga@instructure.com>
QA-Review: Jorge Arteaga <jorge.arteaga@instructure.com>
Product-Review: Marissa Pio Roda <marissa.pioroda@instructure.com>
2024-04-08 18:48:32 +00:00
Chrystal Langston 34c928bae2 Update learning_update_result updated & created live event data
user_uuid, associated_asset, and artifact information is not
available on the live event.  In order for the rubric assessment
audit to be able to successfully audit LOR and AR this information
needs to be added.

title is also being removed as this data contains the student's
first and last name which is considered PII and should not be
passed in live event data. A ticket has been created to remove
the student's name from this column.  See OUT-6302.

closes OUT-6307

flag=none

Test plan:
- Tests are sufficient and Jenkins passes

Change-Id: Ic7f18f9cb3292234b8215e1babf329453be6f1e8
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/344151
Reviewed-by: Angela Gomba <angela.gomba@instructure.com>
QA-Review: Kyle Rosenbaum <krosenbaum@instructure.com>
Product-Review: Kyle Rosenbaum <krosenbaum@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2024-04-08 16:11:45 +00:00
Cody Cutrer 6cd9e94e5f bundle update redis-client
Change-Id: If841390c7bf319fef4b2af2fe4942d23a4cbf3ad
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/342000
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
2024-03-14 22:03:16 +00:00
Cody Cutrer 586acb7604 spec: cleanup usage of timecop
[skip-stages=Flakey]

 * don't use it at all when it's completely unnecessary
 * pass the example as a block in around blocks
 * don't explicitly specify Time.now (it's the default)

Change-Id: I65f7a12c39f4e321f3b2b7f77adfa5beb18d2936
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/341926
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2024-03-05 21:42:41 +00:00
Cody Cutrer 75673a24d4 rails 7.1: spec/lib
closes AE-778

[skip-stages=Flakey]

Change-Id: Ie7143a47c5bd38ca55391a530f7e1b3673ffb4fc
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/340746
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2024-02-21 17:51:31 +00:00
Chrystal Langston a89a128fa2 Add attributes to rubric assessed live event body
This task adds submitted_at, created_at, updated_at,
and attempt attributes to the rubric_assessed live
event body.

closes OUT-6174
flag=none

test plan:
- Tests are sufficient and Jenkins passes

Change-Id: I036b35b9710ae747d8fcf90d338dc5698a2df014
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/340285
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Xander Moffatt <xmoffatt@instructure.com>
Reviewed-by: Dave Wenzlick <david.wenzlick@instructure.com>
QA-Review: Dave Wenzlick <david.wenzlick@instructure.com>
Product-Review: Chrystal Langston <chrystal.langston@instructure.com>
2024-02-21 16:04:42 +00:00
Ricardo Oliveira bb7899f1b9 Push content_export_created live event from Canvas
closes QUIZ-12322

flag = content_export_created

test plan:
- Specs pass
- Hit the content export endpoint with your quiz id
- Verify if the content_export_created has been triggered
- Verify the output in the Kinesis stream
- Verify the paylod and if contains the details
about the Course, Quiz exported

Change-Id: I9d1d2533e707da21089b4b4a7419e3eb3da33c57
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/339084
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jorge Arteaga <jorge.arteaga@instructure.com>
QA-Review: Jorge Arteaga <jorge.arteaga@instructure.com>
Product-Review: Ricardo Oliveira <ricardo.oliveira@instructure.com>
2024-02-16 18:03:54 +00:00
August Thornton 90721ee88a update user access token lookup for canvas oauth
Avoid iterating over _all_ the user's shard associations for
access tokens; query against the user's home shard instead.

fixes FOO-4200
flag = none

test plan:
 • Exercise the OAuth2 flow for a user with multiple access tokens
   and developer keys created at a root account and globally

Change-Id: I4880f0ab4697f8532581af07b62beec9eda58195
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/339261
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: August Thornton <august@instructure.com>
2024-01-31 19:38:40 +00:00
Aaron Shafovaloff 27bcd86945 don't preload sourcemaps (2)
refs CFA-48

Change-Id: I17884021b5fb3d788fd426af76d50ebb8dc701f1
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/339175
Reviewed-by: Keith Garner <kgarner@instructure.com>
QA-Review: Drake Harper <drake.harper@instructure.com>
Product-Review: Drake Harper <drake.harper@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2024-01-29 22:55:56 +00:00
Aaron Shafovaloff 6f9a13e0c8 don't preload sourcemaps
closes CFA-48

Change-Id: I38818cd14e681188663e74251658788054d1158e
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/339163
Reviewed-by: James Butters <jbutters@instructure.com>
Reviewed-by: Keith Garner <kgarner@instructure.com>
QA-Review: Aaron Shafovaloff <ashafovaloff@instructure.com>
Product-Review: Aaron Shafovaloff <ashafovaloff@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2024-01-29 21:35:19 +00:00
Aaron Shafovaloff e1358db735 support multiple entry bundles
this will enable loading of initial entry chunks
in addition to the main entry

this is needed for loading shared vendor chunks

test plan:
  - build passes

Change-Id: I1b170c1df559a7344dd4cd1ea2c915ff41e0f409
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/338722
Reviewed-by: Keith Garner <kgarner@instructure.com>
Reviewed-by: Drake Harper <drake.harper@instructure.com>
Reviewed-by: Kai Bjorkman <kbjorkman@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
QA-Review: Drake Harper <drake.harper@instructure.com>
Build-Review: James Butters <jbutters@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2024-01-25 21:10:01 +00:00
Cody Cutrer 8eeebf32b3 bundle update rubocop
lots of autocorrect of RSpec/RedundantPredicateMatcher, and some
manual corrections of RSpec/RemoveConst (mostly ignoring it)

[skip-stages=Flakey]
[skip-crystalball]

Change-Id: I57a01c06a5f2dafd985912c5ea9dc18e199eddaa
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/337931
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
2024-01-24 16:17:43 +00:00
Jacob Burroughs 3b7130c161 Remove a lot of settings
[ignore-stage-results=Flakey Spec Catcher]

refs AE-551

Change-Id: If7b5191c20cfadc438cdc2bc8b489eb2806582fe
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/334831
Reviewed-by: Isaac Moore <isaac.moore@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Jacob Burroughs <jburroughs@instructure.com>
Product-Review: Jacob Burroughs <jburroughs@instructure.com>
2024-01-09 21:32:17 +00:00
Cody Cutrer e780c75eb2 allow a handful of succesful logins in short succession
fixes AE-656

Change-Id: I0d9c1bf1483322620288119df629e819ac45381d
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/333466
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-11-28 23:19:29 +00:00
Matheus 7ae500f6d2 check user permissions for blueprint setting migration
closes LF-940
flag=none

Test Plan:
- Create a BP course
- With an admin user with no
  manage master courses permissions
- Create a second course and try to
  copy the BP one into it
- Check that the BP settings migration
  option shows up greyed out under import
  all_content
  (oh  and check there is a tooltip there explaining it)
- Check that it does not show up as an option
  on selective import
- Check that even if you enable the checkbox
  and use it, the settings are not imported
  regardless

Change-Id: I622b00cfcf010a9a656c590782c22952c940f1c0
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/333488
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Eric Saupe <eric.saupe@instructure.com>
QA-Review: Eric Saupe <eric.saupe@instructure.com>
Product-Review: Luis Oliveira <luis.oliveira@instructure.com>
2023-11-27 23:00:49 +00:00
Jacob Burroughs 1622650415 Teach cache register to support redis cluster hash tags
fixes AE-655

Change-Id: Ib3c5b1516516cb7a85bb1776fd15873efdbad421
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/333088
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Jacob Burroughs <jburroughs@instructure.com>
Product-Review: Jacob Burroughs <jburroughs@instructure.com>
2023-11-17 22:27:44 +00:00
Chrystal Langston d6ae15d8d7 Add live event rubric_assesed
closes OUT-5885

flag=none

test plan:
- Tests are sufficient and jenkins passes
- Live event is triggered when assessing a rubric associated to an
  assignment for a student in Speedgrader
  - Steps for manual testing:
  - Prereq:
    - A course with an graded assignment that is aligned to a rubric
      with atleast 1 student enrolled
    - Live events are working locally
  - Open terminal and tail sqs logs in Outcomes Service OR tail the
    kinesis logs in Canvas
    - dc logs -f sqs2outcomes
    - OR dc run --rm web script/tail_kinesis http://kinesis live-events
  - Launch Canvas and navigate to course with the rubric aligned
    assignment
  - Open Speedgrader
  - Assess the rubric for the student
  - Verify that the "rubric_assessed" event is present in the logs
  - Back to Speedgrader, assess rubric for the student again
  - Verify that the "rubric_assessed" event is present in the logs

Change-Id: I533aa7eceae8afbee37217ccc5705649ff8df4de
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/330756
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Martin Yosifov <martin.yosifov@instructure.com>
Reviewed-by: Xander Moffatt <xmoffatt@instructure.com>
Reviewed-by: Kai Bjorkman <kbjorkman@instructure.com>
QA-Review: Wilmer Corrales <wilmer.corrales@instructure.com>
Product-Review: Kyle Rosenbaum <krosenbaum@instructure.com>
2023-11-16 21:01:40 +00:00
Cody Cutrer 016bd428ad more appropriately handle redis errors in CacheRegister's cache_key
fixes LF-1004

Change-Id: I99ebdfb0996fd5b159019155c1f1b6f455e0e7d7
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/332739
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Isaac Moore <isaac.moore@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-11-14 19:47:30 +00:00
Cody Cutrer fc0dd0ad8b spec: validate behavior of cache register after failsafe is hit
Change-Id: Iba9f1331f4c40ce5dc73ea76e00ca19c78369506
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/331282
Reviewed-by: Isaac Moore <isaac.moore@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-10-25 15:47:47 +00:00
Matheus ce7b8ed253 Stop always showing blueprint_settings on selective contents
fixes LF-807
flag=none

Test Plan:
- Course copy a non BP course into another
- Opt for a selective import
- Check blueprint settings are not among
  the content options
- Course copy a BP course into a another course
  (the second course can have no students)
- Opt for a selective import
- Check blueprint settings are among the content
  options present in the modal

Change-Id: I0f986c1bb55f45e2441fe4274375e074afa5a335
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/330250
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Juan Chavez <juan.chavez@instructure.com>
Reviewed-by: Eric Saupe <eric.saupe@instructure.com>
QA-Review: Eric Saupe <eric.saupe@instructure.com>
Product-Review: Luis Oliveira <luis.oliveira@instructure.com>
2023-10-17 15:53:20 +00:00
Cody Cutrer 88a5803982 bundle update redis
closes AE-494

[skip-stages=Flakey]
[skip-crystalball]

several things going on here. in general, many of our monkeypatches
have been implemented in upstream, but in a vastly different way, so
we need to enable/configure those things

 * `servers` is no longer accepted as a backwards compatible
   configuration option; use `url`
 * `database` is no longer accepted as a backwards compatible
   configuration option; you _can_ use `db`, but preferable to
   just use `url`
 * no longer merge together redis.yml and cache_store.yml; if one
   references the other, simply use the config from the other
 * `nil_store` is no longer accepted as a backwards compatible
   configuration option; use `null_store` (almost no one should
   be explicitly using this anyway, so nbd)
 * automatically not-even-trying when redis has previously failed
   is now handled by redis-client's circuit breaker. be sure to
   configure it in redis.yml/cache_store.yml/dynamic settings
 * ignoring redis failures completely is already done by
   RedisCacheStore; just rely on that, except for the few cases
   where we use redis directly. some of these now take advantage
   of a new `failsafe` kwarg (and often in combination with
   pipelining), and some just handle it directly
 * move logging to a RedisClient middleware
 * move Twemproxy disallowed commands to a RedisClient middleware
 * simplify Canvas.lookup_cache_store to have far less special casing
   (in particular, patching is done automatically now)
 * add ability to use Redis::Cluster (configure with `nodes` instead
   of `url`)
 * still override Redis::Distributed's HashRing, so that we don't
   change our ring layout with the new MD5 hashing for servers. but
   we got to vastly simplify the new class, due to upstream
   refactorings allowing us to simply override a single method rather
   than having to re-implement the entire class
 * statsd reporting of redis errors is now simply passed as a callback
   to RedisCacheStore, breaking CanvasCache's dependency on InstStatsd

Change-Id: I787672677a21994d40ae304dbac0fbf3a960a779
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/325641
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
2023-09-28 15:49:47 +00:00
Cody Cutrer bb48ac7e15 use built in CacheStore#write_multi instead of re-implementing
refs AE-494

[skip-stages=Flakey]

Change-Id: Ic68a5f2dc4d3ed54af8b09b18597fbe9458ffb95
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/328790
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Aaron Ogata <aogata@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-09-27 17:22:40 +00:00
Cody Cutrer 4e6a6c082c remove shims from CanvasCache extraction
refs AE-494

[skip-stages=Flakey]

Change-Id: Id8f64e0c2b641ef55177e29637db3157160e9b72
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/328786
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Aaron Ogata <aogata@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-09-27 17:07:00 +00:00
Weston Dransfield b6d24d5006 Consider client_id as identifier for service JWTs
This commit squashes two previously seperate commits.

The individual test plans for each commit have been left intact.

Closes CNVS-59219,CNVS-59187
flag=site_admin_service_auth

Test Plan:
- Restart Canvas after pulling change
- Enable the flag
- Make valid requset to the token endponit using a
  client_credentials grant. To be valid, the following
  must be true:
  - The client_id is a usable developer key global ID
  - The client_secret is the api_key of the dev key
  - The developer key has `internal_service: true`
  - The developer key has an associated `service_user`
- Validate an acess token is returned
- Make an API request using the access token. Note
  that you will need to set the User-Agent header to
  something matching the Instructure service user
  agent regexp. For example:
  ```
  inst-service-ninety-nine/1234567890ABCDEF
  ```
- Tail web logs and validate the client identifier
  use by request throttling middleware is:
  ```
  service_user_key:<global developer key ID>"
  ```

Change-Id: I214823b708fedb3e811f123cb986a955f37b95c0

Allow blocking inst_access tokens by jti claims

Test Plan:
- Restart Canvas after pulling change
- Enable the flag
- Make valid requset to the token endponit using a
  client_credentials grant. To be valid, the following
  must be true:
  - The client_id is a usable developer key global ID
  - The client_secret is the api_key of the dev key
  - The developer key has `internal_service: true`
  - The developer key has an associated `service_user`
- Make an API request using the access token. Note
  that you will need to set the User-Agent header to
  something matching the Instructure service user
  agent regexp. For example:
  ```
  inst-service-ninety-nine/1234567890ABCDEF
  ```
- Tail web logs and validate the client identifier
  use by request throttling middleware is:
  ```
  service_user_key:<global developer key ID>"
  ```
- Decode the access token and note the `jti` claim value
- In a Canvas Rails console, add that jti value to
  the request throttling blocklist:
  ```
  Setting.set("request_throttle.blocklist", <jti value>)
  ```
- Attempt to use the token again and validate the http
  response code is 403
- Attempt to make an API request with a standard access
  token and validate throttling middlware does not raise
  an error
- Attempt ot make a request with an active session and validate
  throttling middleware does not raise an error

Change-Id: Ia8448094b7bf0281268bc3dd2d027bb934aa595c
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/323766
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Daniel Matyas Vincze <daniel.vincze@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2023-09-26 22:01:14 +00:00
Weston Dransfield 905cdccbf4 Add client credentials grant type for services
This commit squashes three previously seperate commits.

The end result is that Canvas issues "service user" access
tokens via a client_credentials grant. The tokens issued
are unencrypted inst_access tokens.

The individual test plans for each commit have been left intact

Closes CNVS-59194,CNVS-59194,CNVS-59215
flag=site_admin_service_auth

Test Plan:
- Create a developer key in your local site admin account
- Create a user in the site admin account and note
  their ID. Also make then a site admin admin
- In a rails console, associate the user to the
  key as a service user:
  ```
  key = DeveloperKey.find(<new key>)
  key.update!(service_user: User.find(<new user>))
  ```
- Enable the `site_admin_service_auth` flag
- Make a request the token endpoint using a client
  credentials grant and valid client ID/Secret:
  ```
  http POST 'http://canvas.docker/login/oauth2/token?\
    client_id=<global dev key ID>&\
    client_secret=<dev key api_key>&\
    grant_type=client_credentials'
  ```
- Validate an access token is returned
- Use the token to make a request to `/api/v1/users/self`
  and validate the token was genereted for the
  service user
- Attempt to make the token request with an invalid
  client secret
- Validate a token is not returned
- Attempt to make the token request with the associated
  feature flag disabled
- Validate a token is not returned
- Make the service user's workflow_state "deleted" and
  attempt to make the token request
- Validate a token is not returned
- Set the DeveloperKey's service_user_id to nil and
  attempt the token request
- Validate a token is not returned
- Validate you are unable to retrieve a token when
  the developer key is in a "deleted" state

Allow client_credentials service grant internally

Test Plan:
- Validate the test plan for g/323440 continues
  to pass
- In addition, validate an access token cannot
  be retireved via the client_credentials grant
  type + service user unless the DeveloperKey
  has `internal_service: true`

Use unecrypted inst_access tokens for client_credentials

Also refactor ClientCredentialsProvider initializer to
us kwargs for argument clarity

Test Plan:
- Make a valid token request using a client_credentials
  grant type + a DeveloperKey associated with a
  service_user
- Verify an access token is returned
- Verify the access token is associated with the
  DeveloperKey's service user
- Verify the access token may be used as a bearer
  token in Canvas API endpoints

Change-Id: Ib2a2a3beac1cc04712f8b594e31029471eb359dc
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/326978
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Daniel Matyas Vincze <daniel.vincze@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
2023-09-26 22:00:45 +00:00
Steve McGee a4a2ec0beb provide for better error message on JSON.parse
why: when client credentials is attempting to decode a jwt and the body
that has been returned is not JSON (ie. html) we were just returning
the same error as if the jwt signature was bad which was not helpful.

fixes INTEROP-8220
flag=none

test plan:
there has been a change pushed since this ticket started that causes a
return of "JWT signature invalid" instead of the html we were getting
but that is still not quite right, so these steps will show the old,
current, and new output.

- Make sure your 1.3 dev key uses a public jwk url instead of a
  public jwk (http://lti13testtool.docker/credential_id/1/public_jwk).
- In the test tool run `dcr web rake jwt:access_token CLIENT_ID=<YOUR_DEV_KEY>`
  Current master branch should error with 400 and "JWS signature invalid".
- If you remove the `JSON::ParserError` from the rescue on
  asymmetric_client_credentials_provider.rb:72, it will return an HTML
  error page (as shown in this ticket).
- When you cherry-pick this current change it will error with 400 and
  "Invalid JSON" which is the true error.

Change-Id: I940e21e9e596f59736c99d972d0a7868715dad11
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/327388
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Xander Moffatt <xmoffatt@instructure.com>
QA-Review: Xander Moffatt <xmoffatt@instructure.com>
Product-Review: Alexis Nast <alexis.nast@instructure.com>
2023-09-14 22:36:34 +00:00
Cody Cutrer 12a2c3784f bundle update rubocop-rspec
[skip-stages=Flakey]
[skip-crystalball]

and apply updated copys (RSpec/Eq and RSpec/MetadataStyle, and one
instance that the split RSpec/SpecFilePathSuffix caught)

Change-Id: I3872458f35b791f1ce3f8108a2aaf4fff2cfd612
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/327204
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Isaac Moore <isaac.moore@instructure.com>
Build-Review: Isaac Moore <isaac.moore@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-09-11 15:59:30 +00:00
Cody Cutrer 17b739ed86 use a distinct error message for too recent of successful login
refs AE-483

Change-Id: Icdc0c36a30e56f5d7fb6bdb4cff8460cf03beeec
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/326797
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-09-06 15:23:01 +00:00
Cody Cutrer 0e326a43fd bundle update ddtrace
Change-Id: Ic0189a8f1d42f64c7440621c01d904a86db6748a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/325660
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
2023-08-21 13:22:49 +00:00
Cody Cutrer 15ec75cf72 bundle update twilio-ruby
Change-Id: Ie725fc2227c014741c7ecb10f311b075996ac144
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/325309
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
2023-08-16 12:22:00 +00:00
Derek Williams 03fc0421fc add anonymous_grading field to 'assignment_updated' live event
closes EVAL-3392
flag=anonymous_marking

test plan:
- update an assignment to emit a live event
- ensure `anonymous_grading` field is present in the live event

Change-Id: I8cecb06064cbd0b9dcd142e85eb636edbe893161
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/324779
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Cameron Ray <cameron.ray@instructure.com>
Reviewed-by: Kai Bjorkman <kbjorkman@instructure.com>
Reviewed-by: Christopher Soto <christopher.soto@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Spencer Olson <solson@instructure.com>
Product-Review: Cameron Ray <cameron.ray@instructure.com>
2023-08-15 13:07:28 +00:00
Cody Cutrer 8f8f6f7313 bump rubocop gems and apply changes
[skip-stages=Flakey]

Change-Id: I5f080be6efb64351b4a89e6bd6040bc6f0432e82
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/323854
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
2023-08-07 20:13:35 +00:00
Cody Cutrer 208d18967a prohibit rapid-fire succesful logins
fixes CANVAS-KSBE

Change-Id: I0e0dd5e34dfaa6bbd5661adbe9015430e5bdacd8
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/324165
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-08-07 16:35:52 +00:00
Ryan Hawkins a7c4799711 Fix asymmetric_client_credentials_provider bug
In b91a0cdcc2, the AsymmetricClientCredentialsProvider was changed to
use CanvasHttp instead of HTTParty. However, we forgot to adjust the
one of the call sites to call JSON.parse(response.body) instead of
response.parsed_response. This fixes that.

flag=none

refs CANVAS-KQHT

test-plan:
- Setup live events locally, or somehow get an asymmetric OAuth2
  situation set up.
- Try and go through the typical OAuth2 flow.
- See that things work properly and no error is thrown.

Change-Id: Ic2b371abe30bbf29ebabfa37ed4745711933d955
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/324408
Reviewed-by: Cody Cutrer <cody@instructure.com>
Reviewed-by: Xander Moffatt <xmoffatt@instructure.com>
QA-Review: Xander Moffatt <xmoffatt@instructure.com>
Product-Review: Ryan Hawkins <ryan.hawkins@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2023-08-03 21:38:26 +00:00
Cody Cutrer b91a0cdcc2 use CanvasHttp for OAuth asymmetric JWK requests
also handle errors fetching it

fixes CANVAS-KQHT

Change-Id: I31f6b78674f0e45ae07ddb1b76d98e62efef4c26
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/323566
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2023-07-28 16:34:59 +00:00
Aaron Suggs 8d76497d54 Add CodeOwnership support to CanvasErrors
As a developer, I’d like to know which Sentry errors my team is
responsible for. Since Canvas is owned by multiple teams, it can take some
effort to determine which team is responsible for a particular sentry
error.

The code_ownership gem can help. It lets us define YAML configs with path
globs of which teams own which files. As an error bubbles up, it uses the
stack trace to know which team best "owns" the error.

In this commit, we add an `inst.team` tag to the error that will be
sortable / filterable in Sentry.

The next step is to add CodeOwnership config and definitions to the
canvas-lms rails app.

This is a Hack Week project.

refs VICE-3684

Test plan:
  - specs pass

flag=none

Change-Id: Ifdd5cac0e33c92b2c9112e70b3c7e3a9a9d4e023
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/323629
Reviewed-by: Isaac Moore <isaac.moore@instructure.com>
Reviewed-by: Omar Soto-Fortuño <omar.soto@instructure.com>
Build-Review: Isaac Moore <isaac.moore@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Omar Soto-Fortuño <omar.soto@instructure.com>
Product-Review: Omar Soto-Fortuño <omar.soto@instructure.com>
2023-07-27 14:50:25 +00:00
Cody Cutrer 61df8f99f2 implement failsafe local caching of cache store config
refs AE-380

Change-Id: Ie66913a4762d7c1a4a4e1d68b31d3e0bed4cb3a6
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/322299
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Isaac Moore <isaac.moore@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-07-12 14:52:15 +00:00
Roberto Noguera 8a8eca6e38 Add param to live event messages for course copy
creating a new database field to track the orignal outcome id in
copied outcomes with the course copy process, adding the new param
in the live event message to outcome service.

closes OUT-5561
closes OUT-5562
closes OUT-5571
flag=none

test plan:
- Tests pass

Change-Id: If53821426a115a0f6635d22cf59026c14892bace
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/316476
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Chrystal Langston <chrystal.langston@instructure.com>
QA-Review: Chrystal Langston <chrystal.langston@instructure.com>
Product-Review: Kyle Rosenbaum <krosenbaum@instructure.com>
Migration-Review: Cody Cutrer <cody@instructure.com>
2023-07-10 23:57:37 +00:00
James Logan bad8bcac9c Send resource_map when importing as quizzes next
This allows us to perform link migration when migrating
from old to new quizzes during an import.

closes LF-465
flag=content_migration_asset_map_v2
flag=new_quizzes_migration

Test Plan:
- Specs pass
- Monitor your local canvas live events with the tail_kinesis script
- Make a course export from a course with no new quizzes.
- Using that course export, Perform a course import with
  `import as new quizzes` checked.
- Observe in the live event stream that the resource_map_url is populated
  in the content_migration_completed live event.
- Perform another import into an new course without checking
  `import as new quizzes`.
- Observe in the live event stream that the resource_map_url is
  not populated.

Change-Id: Iaec7d0618e88c4785f9cb7061801dbbfbb82ae90
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/322320
Reviewed-by: Paul Gray <paul.gray@instructure.com>
QA-Review: James Logan <james.logan@instructure.com>
Product-Review: Mysti Lilla <mysti@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2023-07-10 19:34:10 +00:00
Caleb Guanzon 6e7b90958b spec: reply from triggers live event
this is in relation to
VICE-3599

this test proves that, the reply_from method in
ConversationMessage and Conversation (this method processes)
Incoming mail as replies to a conversation:

triggers a live event

if the end user does not see the live event, the problem could be
somewhere else, this could require LiveEvents expertise more
than ConversationMessage expertise

Change-Id: I20469ef44d1ad1bcc6785adf845bf6f4ccc36595
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/322376
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Drake Harper <drake.harper@instructure.com>
Reviewed-by: Jason Gillett <jason.gillett@instructure.com>
QA-Review: Drake Harper <drake.harper@instructure.com>
Product-Review: Drake Harper <drake.harper@instructure.com>
Product-Review: Jason Gillett <jason.gillett@instructure.com>
2023-07-10 18:58:11 +00:00
Cody Cutrer 5431d47758 rubocop: Rails/I18nLocaleAssignment
manually done. the big one was the explicit locale assignment
in set_locale_with_localizer needs undone in a controller callback

then using with_locale everywhere, specs no longer need to be concerned
about being in an uncertain locale

Change-Id: I5a1d2c907a6f52ee4d8c2307b8c789a1f1ea436e
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/320112
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-06-13 21:59:50 +00:00
Jacob Burroughs 7dcc507d0a Rubocop for ruby 3.1
[skip-stages=Flakey]

Change-Id: I6abefdfa9fed6dd4525c8786e93efa548b3710f2
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/319603
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Isaac Moore <isaac.moore@instructure.com>
QA-Review: Jacob Burroughs <jburroughs@instructure.com>
Product-Review: Jacob Burroughs <jburroughs@instructure.com>
Build-Review: Jacob Burroughs <jburroughs@instructure.com>
Migration-Review: Jacob Burroughs <jburroughs@instructure.com>
2023-06-06 16:44:26 +00:00
Jackson Howe 7e0e19f885 Remove copy_blueprint_settings flag
closes LF-286
flag = none

Test plan:
 - Create a course and set it as a blueprint course in course settings
 - In course settings, select "Locked Objects By Type" and define a few
   types as locked
 - Save settings
 - Click "copy course" in the sidebar
 - Check "copy blueprint settings"
 - Expect the blueprint settings to be preserved in the new course

Change-Id: Iab6c174cdf5f25d3922290d29d1fe2f1091c98aa
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/318567
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jonathan Guardado <jonathan.guardado@instructure.com>
QA-Review: Jonathan Guardado <jonathan.guardado@instructure.com>
Product-Review: Jackson Howe <jackson.howe@instructure.com>
2023-05-22 20:02:41 +00:00
Cody Cutrer 80f97039c0 bump and apply rubocop gems
[skip-stages=Flakey]

Change-Id: I473807528062dfc9e8e983728c6d27726513686c
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/318465
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Build-Review: Cody Cutrer <cody@instructure.com>
2023-05-19 18:57:17 +00:00
Aaron Ogata 7cb318f2c9 use vault role instead of hard coded access key / secret
refs AE-49

[skip-crystalball]
[skip-stages=Flakey]

Change-Id: I6f9ff053a3cd72ac063d522cef11da7264a9527b
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/317335
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Isaac Moore <isaac.moore@instructure.com>
QA-Review: Aaron Ogata <aogata@instructure.com>
Product-Review: Aaron Ogata <aogata@instructure.com>
Build-Review: Aaron Ogata <aogata@instructure.com>
2023-05-08 14:59:54 +00:00
Xander Moffatt e603818800 correctly set environment in live events heartbeat
why:
* it was sending "production" always
* I want to be able to partition between prod and beta in Datadog

refs INTEROP-7143
flag=none

test plan
* specs

Change-Id: Ie466b5b465db889f5103795bf7d1ea1b6987cd69
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/317445
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Steve Mcgee <steve.mcgee@instructure.com>
QA-Review: Xander Moffatt <xmoffatt@instructure.com>
Product-Review: Xander Moffatt <xmoffatt@instructure.com>
2023-05-02 18:07:48 +00:00
Cody Cutrer 502aa068da rubocop: Layout/Multiline*LineBreaks
[skip-stages=Flakey]

Change-Id: I24912809267088bc19a4082c49bc5f78ca7b76bb
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/317302
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
Build-Review: Jacob Burroughs <jburroughs@instructure.com>
Migration-Review: Jacob Burroughs <jburroughs@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2023-05-01 19:31:42 +00:00