Commit Graph

2370 Commits

Author SHA1 Message Date
James Williams 47a1b325ce add additional request cost for oauth2 token request
Change-Id: I47ce5b1b299de42a13a61d01a010253bc4e7687c
Reviewed-on: https://gerrit.instructure.com/180752
Tested-by: Jenkins
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Tucker Mcknight <tmcknight@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2019-02-07 00:52:11 +00:00
Han Yan 2fbc0e5762 "Retry" button doesn't work for a failed Course copy
refs QUIZ-5864

test plan:
- do a course copy
- find an assignment, set workflow_state to 'failed_to_duplicate'
  in rails console
- expect Retry button is available in UI
- click Retry button and wait, the failed assignment can be duplicated
  again
- regression on assignment copy, course copy

Change-Id: I1594a68cf15c4994cd916b25e100ed277cc6cdc1
Reviewed-on: https://gerrit.instructure.com/180012
Tested-by: Jenkins
Product-Review: Hannah Bottalla <hannah@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
2019-02-04 17:12:29 +00:00
Matt Sessions ebfb0d26ad Add hide_points to rubric settings returned in api
refs: MBL-11907
Test Plan:
 - Create an assignment and align a rubric
 - toggle the "Remove points from rubric" setting
 - view the assignment in the api
 - the rubric_settings object in the response should
   include the value of the hide_points field"

Change-Id: Iab2c7196f1134841cd89379347ee811a1944e584
Reviewed-on: https://gerrit.instructure.com/180241
Tested-by: Jenkins
Reviewed-by: Matthew Berns <mberns@instructure.com>
Reviewed-by: Nate Armstrong <narmstrong@instructure.com>
QA-Review: Nate Armstrong <narmstrong@instructure.com>
Product-Review: Matt Sessions <msessions@instructure.com>
2019-02-04 15:57:38 +00:00
James Williams 7bf166bdec prevent double-sending of summary messages
closes #CORE-2424

Change-Id: I7edb470c04bbbca71dc39d5530cfd6bcaf9d50d3
Reviewed-on: https://gerrit.instructure.com/179924
Tested-by: Jenkins
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
2019-02-01 22:04:23 +00:00
Gary Mei 3323376988 update submission graded_at after missing policy
closes GRADE-1648

Test Plan
- Create a Missing Policy for the course.
- Create an assignment due 1 minute from now.
- Load the Gradebook and verify that the submissions are not
  considered missing.
- Wait for the due date to pass.
- Refresh the Gradebook until the cells indicate missing, and there
  is the Missing score applied to those submissions.
- Do a GET request to this endpoint:
  `api/v1/courses/:course_id/assignments/:assignment_id/submissions/:id`
- Verify that the graded_at is not nil, and is accurate to when the
  submission had the missing policy applied to it.

Change-Id: Ia709a3d8420d70838a95c5f774a492c5088ae2be
Reviewed-on: https://gerrit.instructure.com/179344
Reviewed-by: Derek Bender <djbender@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
Tested-by: Jenkins
QA-Review: Indira Pai <ipai@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2019-01-31 19:27:08 +00:00
Xander Moffatt d22a9f00fd provide more fields in discussion_topic_created event
closes PLAT-3843

test plan:
* enable live events locally (see doc/live-events.md)
* tail the stream (see same doc)
* create a new discussion topic
* look at the stream and see if the new
fields have been added to the event

Change-Id: I0bc9aef8ae82faac37df7a6f1feffd38e4961664
Reviewed-on: https://gerrit.instructure.com/178920
Tested-by: Jenkins
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Product-Review: Xander Moffatt <xmoffatt@instructure.com>
2019-01-25 17:19:20 +00:00
Adrian Packel b5b3ac7932 Add migration and backfill for posted_at
closes GRADE-1857

Test plan:
- Make sure you have at least one Submission with a non-nil graded_at
  date (you can set one in the Rails console)
- Run migrations
- Check that there are no submissions with a posted_at date different
  from the graded_at date (this should return false):
  > Submission.exists?("graded_at <> posted_at")

Change-Id: I98ccb968009cfe1649b728a65ed40e292f024868
Reviewed-on: https://gerrit.instructure.com/178305
Tested-by: Jenkins
Reviewed-by: Gary Mei <gmei@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Reviewed-by: Derek Bender <djbender@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2019-01-24 16:18:26 +00:00
Matthew Berns 0e6f61ba83 add hide_score_total to rubric_settings
fixes OUT-2901

test plan:
- create an assignment and align a rubric
- toggle the "Hide score total for assessment results" setting
- view the assignment in the API
- the rubric_settings part of the response should include the setting
  of the hide score total setting placed on the assignment rubric

Change-Id: I0b28a8bf731aaf38618f4a5df8c5ec2581ef3d69
Reviewed-on: https://gerrit.instructure.com/177944
Tested-by: Jenkins
Product-Review: Matthew Berns <mberns@instructure.com>
Reviewed-by: Neil Gupta <ngupta@instructure.com>
Reviewed-by: Augusto Callejas <acallejas@instructure.com>
QA-Review: Dariusz Dzien <ddzien@instructure.com>
2019-01-23 23:06:10 +00:00
wdransfield bf4aaae0ed Add "future buffer" to iat validation for client credentials grant
Closes PLAT-4157

Test Plan:
Attempt to retrieve an access token using a client credentials
grant. The iat of the claimshould be 10 seconds in the future.
Verify you are still able to retrieve an access token.

Verify you cannot retrieve an access token if the iat is more than
30 seconds in the future.

Change-Id: I884f569c3ab4bcafaaa459c70fe3d0c2326153cd
Reviewed-on: https://gerrit.instructure.com/178477
Reviewed-by: Marc Phillips <mphillips@instructure.com>
QA-Review: Marc Phillips <mphillips@instructure.com>
Tested-by: Jenkins
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2019-01-18 17:54:58 +00:00
Rob Orton 3805e3bc78 leave enrollments when a pseudonym is deleted
closes gh-1402

test plan
 - Create a user with two logins
 - have an enrollment tied to the sis id of one
 - delete that pseudonym
 - run a sis import enrollments referencing the
   deleted sis id
 - the enrollment should still be active

Change-Id: I350a998f53aae00662f2a133c17dd9596793ed6a
Reviewed-on: https://gerrit.instructure.com/178116
Tested-by: Jenkins
Reviewed-by: James Williams <jamesw@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
QA-Review: James Williams <jamesw@instructure.com>
2019-01-17 15:27:57 +00:00
wdransfield 7de0f76588 Handle string claims and protocol in client credentials grant
Closes PLAT-4143

Test Plan:
- Attempt to retrieve an access token using the client
  credentials grant type. Make the exp or iat claims
  non-numeric
- Verify Canvas responds with a 400 and error message
- Verify the aud must be https

Change-Id: Iefc9b286d9198f0afd759c9a05b1dd8b22647aa4
Reviewed-on: https://gerrit.instructure.com/177837
Tested-by: Jenkins
Reviewed-by: Marc Phillips <mphillips@instructure.com>
QA-Review: Marc Phillips <mphillips@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2019-01-16 19:12:22 +00:00
Gary Mei 5dcc11bce5 allow peer reviewers to view anonymous submissions
Submissions to anonymous assignments were hidden from peer reviewers
while the assignment was still muted, but now peer reviewers are able
to peer review the same as they would for any other assignment.

closes GRADE-1675

Test Plan
- Create a peer review, anonymous assignment.
- Have Student 1 submit to the assignment.
- As the teacher, assign the two students to peer review each other.
- As the teacher, leave comments for Student 1.
- As the students, leave comments for Student 1.
- As the teacher, verify the following:

  - The teacher does not see Student 1 or 2's identities in
    SpeedGrader, and remains unable to view the submission details
    page.
  - The peer reviewer (Student 2) sees only their own comments.
  - The student (Student 1) sees only their own comment.

Change-Id: Ie8df4fde0c1391c20461bf1d64d13385179db370
Reviewed-on: https://gerrit.instructure.com/177521
Tested-by: Jenkins
Reviewed-by: Keith Garner <kgarner@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Jonathan Fenton <jfenton@instructure.com>
2019-01-15 19:05:36 +00:00
wdransfield 61d200a3e7 Use ext_roles for roles claim in LTI 1.3 launches
Closes PlAT-4110

Test Plan:
- Do an LTI 1.3 launch
- Verify the roles claim contains the `ext_roles`
  from LTI 1 rather than the `roles`.

Change-Id: I9d20a33b6a2f8997353f4198de880a80df43ed8c
Reviewed-on: https://gerrit.instructure.com/177280
Tested-by: Jenkins
Reviewed-by: Marc Phillips <mphillips@instructure.com>
QA-Review: Marc Phillips <mphillips@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2019-01-10 22:23:43 +00:00
Marc Phillips 60e6674216 Add resource title and description to claim
closes PLAT-4109

Test Plan:
 - Note that a resourcelink launch from an assignment
   now contains the title and description in the
   resourcelink claim

Change-Id: I5d04c060146c429c00d8ab1f560a6f055931a8b3
Reviewed-on: https://gerrit.instructure.com/177315
Tested-by: Jenkins
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Product-Review: Marc Phillips <mphillips@instructure.com>
2019-01-10 17:00:02 +00:00
Marc Phillips a0a7190227 Add target_link_uri to spec
closes PLAT-4107

Test plan:
 - Using the test tool, do a launch and see that
   the target_link_uri is sent on the login and
   the final launch as a claim

Change-Id: I32da1f86a5a0c47e3aee6d66aeac74439696276b
Reviewed-on: https://gerrit.instructure.com/177299
Tested-by: Jenkins
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Product-Review: Marc Phillips <mphillips@instructure.com>
2019-01-09 22:25:38 +00:00
Rob Orton 9d655422ed handle empty columns on sis import
fixes CORE-2325

test plan
 - run an import that has an empty column
 - it should not error out with unhelpful error

Change-Id: Ieb2dd6186dd25178f5755f5b74b2d567ca25a70f
Reviewed-on: https://gerrit.instructure.com/177166
Tested-by: Jenkins
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
2019-01-09 19:55:47 +00:00
wdransfield 91870dfd91 Remove all extensions from LTI JWT messages
Closes PLAT-4111

Test Plan:
Verify LTI 1.3 launch payloads do not contain canvas
extensions.

Change-Id: Ifa540b4a08a2e4dd726fab4612702c5ec5ebb61b
Reviewed-on: https://gerrit.instructure.com/177206
Tested-by: Jenkins
Reviewed-by: Marc Phillips <mphillips@instructure.com>
QA-Review: Marc Phillips <mphillips@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2019-01-09 17:51:56 +00:00
Marc Phillips 6f6e5f8c48 Fix client_credentials grant tokens
Erroneously checking the jti as if it was a nonce.
This allows the tokens to be used more often than
once.

closes PLAT-4084

Test Plan:

Generate a ccg token and attempt to make a call
a few times. Note that it works. Make sure that
you have redis enabled locally.

Change-Id: I4eeed1019ac9ca04956713ed84a2a922b4ffdde0
Reviewed-on: https://gerrit.instructure.com/176586
Reviewed-by: Nathan Mills <nathanm@instructure.com>
QA-Review: Nathan Mills <nathanm@instructure.com>
Tested-by: Jenkins
Product-Review: Marc Phillips <mphillips@instructure.com>
2019-01-02 21:25:58 +00:00
Augusto Callejas 299535a962 Further specify order of outcome results
closes OUT-2899

test plan:
  - in a course, create an outcome
  - create 5 assignments aligned to that outcome
  - as a student, submit to all the assignments
  - as a teacher, provide a rubric assessment to all submissions
  - in a separate browser tab, confirm that 5 results show up
    (so no skipped results and no repeating results), in result id
    order, using two different pagination approaches (replace
    "1" with the actual course id and prefix each call with
    the domain being tested, like http://canvas.docker):

   * 2 results per page
   /api/v1/courses/1/outcome_results/?per_page=2&page=1
   /api/v1/courses/1/outcome_results/?per_page=2&page=2
   /api/v1/courses/1/outcome_results/?per_page=2&page=3

   * 10 results per page
   /api/v1/courses/1/outcome_results/?per_page=10

Change-Id: I963c6c89e395e2a9de9914152cbd92f375ce8b4d
Reviewed-on: https://gerrit.instructure.com/176507
Tested-by: Jenkins
Reviewed-by: Matthew Berns <mberns@instructure.com>
QA-Review: Brian Watson <bwatson@instructure.com>
Product-Review: Neil Gupta <ngupta@instructure.com>
2019-01-02 17:27:42 +00:00
Hannah Bottalla f6d14850f4 Fix grade and score parameters in QuizzesNextVersionedSubmission
closes: QUIZ-5725

test plan:
1. Create a quizzes.next quiz with Display Grade As Incomplete/Complete
or another type besides points
2. Take the quiz
3. Verify in the gradebook it shows the grade correctly

Change-Id: I005fb89b02a18372fc257c59867f35f53e240dee
Reviewed-on: https://gerrit.instructure.com/176346
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
QA-Review: Stephen Kacsmark <skacsmark@instructure.com>
Tested-by: Jenkins
Product-Review: Hannah Bottalla <hannah@instructure.com>
2018-12-22 00:00:41 +00:00
Marc Phillips 3f10c83497 Add unique lti_id to users
closes PLAT-4050

Test Plan:
 - create a user, should work
 - update a user, should work
 - attempt to change the lti_id in teh console, should fail
 - attempt a 1.3 launch and note that id is changed to new id
   - also note the lti11_legacy_user_id field is present

Change-Id: I2747d76b08714a66cd2862b81c4f50e5068021e8
Reviewed-on: https://gerrit.instructure.com/174693
Reviewed-by: Rob Orton <rob@instructure.com>
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Tested-by: Jenkins
Product-Review: Marc Phillips <mphillips@instructure.com>
2018-12-19 18:21:54 +00:00
Gary Mei 7688733392 update submission workflow_state and updated_at
When a submission's workflow_state is changed as a result of
DueDateCacher running, the updated_at wasn't being touched, resulting
in a stale cache key and permissions not reflecting the state of
the submission now.

fixes GRADE-1846

Test Plan
- Create an assignment, and manually assign it to multiple students.
- Edit the assignment, and remove one of the students from the
  assignment.
- Attempt to grade the student via the api:
  `api/v1/courses/{course_id}/assignments/{assignment_id}/submissions
     /{submission_id}?submission[posted_grade]=10`
- The response should be a 401, since the student's submission is not
  currently assigned to that assignment.
- Edit the assignment so that the student is now assigned to the
  assignment again.
- Attempt once more to grade the student via the api; verify that
  a successful response is given.

Change-Id: I6d291f0972a921ef9f5cd2722b491e9e52b51ed0
Reviewed-on: https://gerrit.instructure.com/175715
Tested-by: Jenkins
Reviewed-by: Keith Garner <kgarner@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
QA-Review: Gary Mei <gmei@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2018-12-18 19:40:01 +00:00
Jeremy Stanley c12de7d5f8 rewrite content_notices to use InstUI Alert
test plan:
 - enable redis
 - in the rails console, for a given course, do
   course.add_content_notice :import_in_progress, 1.hour
 - navigate to a page in that course as a user who has
   manage_content permission
 - the "One ore more items are currently being imported" message
   should appear at the top of the page and should be read
   to screenreaders

fixes ADMIN-2208

Change-Id: I39f2efe231c27e009aee0b13bbe26dc8fa37bad5
Reviewed-on: https://gerrit.instructure.com/175149
Tested-by: Jenkins
Reviewed-by: Ed Schiebel <eschiebel@instructure.com>
QA-Review: Daniel Sasaki <dsasaki@instructure.com>
Product-Review: Daniel Sasaki <dsasaki@instructure.com>
2018-12-17 16:58:06 +00:00
Keith T. Garner 337c3e7bc1 add multiple attempts to calculating grades jobs
Grade calculation is really important.  Let's attempt up to 10 times if
the job fails or is killed.

closes GRADE-1895

test plan:
 - Jenkins passes

Change-Id: I6003e971600f85de5d35b85bec42c3bb4f5bebad
Reviewed-on: https://gerrit.instructure.com/175563
Tested-by: Jenkins
Reviewed-by: Derek Bender <djbender@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
QA-Review: Keith Garner <kgarner@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2018-12-17 15:34:21 +00:00
Adrian Packel 7a0ff000d4 Set format of CSV exported/imported values
Export scores in CSV files with 2 digits of precision to match what is
shown in Gradebook, and compare against existing scores at that same
precision when importing. Do not include thousands separators.

fixes GRADE-871

Test plan:
- Have a course with some students and a points-based assignment
- Enter a score greater than one thousand
- Enter a score with three decimals of precision that rounds up
  (e.g., 123.456); this will display as 123.46
- Export the CSV file
- In the CSV:
  - Scores greater than one thousand should *not* include any
    thousands separators
  - All scores should appear with a precision of two decimal places
    (even if there is no decimal component), with whatever rounding
    that entails
- Re-import the CSV without modifying it
  - You should be told that no changes were found (i.e., the lack of
    a thousands separator and the rounding should not cause false
    positives)
- Make some changes to those values and reimport the CSV
  - The import page should identify your changes as expected

Change-Id: Ia88d257b4ea57bf72ac25773fdd1ccdbd0ee605b
Reviewed-on: https://gerrit.instructure.com/173856
Tested-by: Jenkins
Reviewed-by: Keith Garner <kgarner@instructure.com>
Reviewed-by: Gary Mei <gmei@instructure.com>
QA-Review: Gary Mei <gmei@instructure.com>
Product-Review: Sidharth Oberoi <soberoi@instructure.com>
2018-12-11 18:49:57 +00:00
Jacob Fugal 3d2bc63a48 prefer display name over filename, but encode it
fixes SAS-418, SAS-338

inst-fs will read the segment of the path following the UUID and attempt
to use it as the filename in the content-disposition header when it
serves the file. prefer using the display name over the filename for
that, so that when if the file is served as a download (vs. inline) it
is saved according to the display name on the user's machine. but we
need to make sure to URI encode it before putting it in the path, in
case of any special characters in the display name.

test-plan:
 - have inst-fs enabled
 - upload a file
 - rename the file
 - download the file; should save according to the new name, not the
   original name
 - rename the file to have special characters in it (spaces,
   URI-specific symbols like "?" or "/", non-UTF-8 characters, etc.)
 - download the file; should save according to the new name, but the URL
   downloaded from (i.e. check the inst-fs URL redirected to) should
   have those characters escaped

Change-Id: Ic6fb3cbafffb51791605c7a6ba2e29117213576e
Reviewed-on: https://gerrit.instructure.com/174739
Tested-by: Jenkins
Reviewed-by: Michael Jasper <mjasper@instructure.com>
QA-Review: Michael Jasper <mjasper@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
2018-12-11 16:42:08 +00:00
Keith T. Garner 2d734d014e update updated_at when soft-deleting submissions in duedatecacher
In DueDateCacher when soft deleting via changing the workflow_state
via update_all also update the updated_at timestamp. This will help us
trace back events that may have caused a submission to be deleted.

closes GRADE-1886

test plan:
 - Have a course with an assignment with a due date and two students
 - Unassign one of the students from the assignment
 - Using a rails console, find the student's soft deleted submission
   record.
 - Note that the updated at matches the time you made a visibility
   change.

Change-Id: If0af4e420ac75f865d2954f1454ffae106e13a98
Reviewed-on: https://gerrit.instructure.com/174937
Reviewed-by: Adrian Packel <apackel@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
QA-Review: James Butters <jbutters@instructure.com>
Tested-by: Jenkins
Product-Review: Keith Garner <kgarner@instructure.com>
2018-12-11 15:35:00 +00:00
Han Yan 02262065fd fix exceptions due to nil url in a Q.N submission
closes QUIZ-5701

test plan:
- create a Q.N quiz (with at least a student for the course)
- go to speedgrade and see there is no submission from a student
- simulate a Canvas internal update:
  rails console to Canvas, and find the submission
  set submission.grader_id = 1
  after submission.save!, we can check
    submission.versions.count # should be 1
- check the api url from browser, no error should be there:
  <canvas_url>/api/v1/courses/<course_id>/assignments/<assignment_id>/submissions?include[]=submission_history

Change-Id: Ifcfecea7de80db578bc57c71076cf63db6023895
Reviewed-on: https://gerrit.instructure.com/174874
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
Tested-by: Jenkins
QA-Review: Stephen Kacsmark <skacsmark@instructure.com>
Product-Review: Han Yan <hyan@instructure.com>
2018-12-10 22:59:37 +00:00
James Williams 3e161cb6e8 partition messages
test plan:
* run the migrations
* sending messages and viewing them as an admin
 should work as before

closes #COMMS-1327

Change-Id: If955b49d07fa68f8a5151984eb4d9c3b97b118ee
Reviewed-on: https://gerrit.instructure.com/170657
Tested-by: Jenkins
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: James Williams <jamesw@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2018-12-10 13:42:35 +00:00
wdransfield 980f8c86bc Add deep linking response endpoint
Closes PLAT-4059, PLAT-4060

Test Plan:
- Verify hitting the new endpoint with a valid JWT
  results in a 200 response
- Verify a bad request with an error is returned
  for the following cases:
  * When the aud is not the Canvas iss
  * When the JWT params is not a JWT
  * When the alg is not RS256
  * When the JWT is not signed with the correct
    private key
  * When the developer key is not found
  * When the developer binding is not 'on'
  * When the develoepr key is not 'active'
  * When the iat is in the future
  * When the exp is in the past
  * When the nonce has already been used

Change-Id: Ie184fb784212540ad1059b609fa94421c18de31e
Reviewed-on: https://gerrit.instructure.com/174378
Tested-by: Jenkins
Reviewed-by: Marc Phillips <mphillips@instructure.com>
QA-Review: Marc Phillips <mphillips@instructure.com>
Product-Review: Jesse Poulos <jpoulos@instructure.com>
2018-12-07 23:29:00 +00:00
Jeremy Stanley 4326bd8460 enhance course link validator
this commit includes the following enhancements:
 * broken course card images are detected
 * deleted flickr images (redirects to image_unavailable.png)
   are treated as broken
 * the type and icon for each resource that has broken links
   are included in the list
 * broken links in each resource are grouped by the type of
   brokenness, with explanatory text
 * broken external URL items in modules are grouped by module
 * link text for bad links is shown, rather than just
   the URL

test plan:
 - add the following to various objects in a course:
   - a flickr image (that isn't deleted or broken)
   - a flickr image where the name part of the URL has been changed
     (so it redirects to an "image_unavailable.png")
   - an image with an invalid hostname
     (so it is unreachable)
   - a broken image of some sort as the course card image
   - links to an unpublished item
   - some external URL module items in multiple modules
     with broken URLs
 - run the Course Link Validator (from Course Settings, right sidebar;
   ensure jobs are running)
 - make sure the good flickr image isn't reported as broken
 - make sure the broken flickr image is
 - make sure the results include the course card image
 - make sure the unpublished item appears
   when the "Show links to unpublished content" is checked
 - make sure the broken external URL module items appear
   under their corresponding modules

closes ADMIN-2280

Change-Id: Ia30d128eb19244cca34f64dc716d7c6f5ef1cdf8
Reviewed-on: https://gerrit.instructure.com/173440
Reviewed-by: Carl Kibler <ckibler@instructure.com>
Tested-by: Jenkins
QA-Review: Anju Reddy <areddy@instructure.com>
Product-Review: Christi Wruck
2018-12-07 20:23:21 +00:00
James Williams 7fd45d3691 use bigdecimal() instead of bigdecimal.new
removed in 2.6

Change-Id: I092b437c6e51f4279bd113e6a57422b3a4f2d99c
Reviewed-on: https://gerrit.instructure.com/174638
Tested-by: Jenkins
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: James Williams <jamesw@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2018-12-07 20:07:51 +00:00
Jeremy Neander 66eee60398 create endpoint for final grade overrides
closes GRADE-1876

test plan:
 Notes:
  * To test the endpoint, send use the path:

     GET /courses/:course_id/gradebook/final_grade_overrides

  * To set overrides, perform the following in the Rails console:

     enrollment = course.enrollments.find_by(user_id: <student.id>)

     # to update a course score
     score = enrollment.scores.find_by!(course_score: true)
     score.update!(override_score: 89.2) # some score value

     # to update a grading period score
     period = <some grading period>
     score = enrollment.scores.find_by!(grading_period: period)
     score.update!(override_score: 89.2) # some score value

 A. Setup
    1. Select or create a course
    2. Ensure the course has at least one assignment
    3. Enable the "Final Grade Override" feature flag
    4. Use an enrollment term with some grading periods
    5. Override a student's course score
    6. Override a student's grading period score

 B. Verify
    1. As a teacher in the course, send a request to the endpoint
    2. Verify the response is structured as follows:

       {
         final_grade_overrides: {
           <student_id>: {
             course_grade: {
               percentage: 12.34
             },
             grading_period_grades: {
               <grading_period_id>: {
                 percentage: 56.78
               },
               <grading_period_id>: {
                 percentage: 90.12
               }
             }
           },
           <student_id>: {…}
         }
       }

    3. Verify the response includes ids of only students with
       overrides
    4. Verify each student represented includes scores for only the
       specific overrides assigned
       * not all grading period ids will be included if they do not
         all have overrides
       * the course grade override will not be included if not
         assigned
    5. Verify the override percentage values are accurate

Change-Id: I0e7df11139518b94460883d3dbd4700cba9aaeda
Reviewed-on: https://gerrit.instructure.com/174017
Tested-by: Jenkins
Reviewed-by: Gary Mei <gmei@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2018-12-07 18:26:39 +00:00
James Williams da38ca1ef0 remove iconv
Change-Id: I4786663805d277f028531d9c4a85a147427e7c66
Reviewed-on: https://gerrit.instructure.com/173987
Tested-by: Jenkins
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: James Williams <jamesw@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2018-12-06 17:14:18 +00:00
Adrian Packel feba966ac2 prevent unmute if moderated and unpublished
Do not allow the assignment API to unmute moderated assignments whose
grades have not been published.

fixes GRADE-1844

Test plan:
- Set up a moderated assignment
- Using the API endpoint, test the following:
  - For a moderated assignment with no grades published
    - Attempting to unmute it should fail
    - Muting it manually, via the console, and then attempting to mute
      it via the API should succeed
  - For a moderated assignment with grades published
    - You should be able to unmute or mute as desired
  - For a non-moderated assignment
    - You should be able to unmute or mute as desired

API endpoint (as a PUT):
/api/v1/courses/<courseID>/assignments/<assignmentID>

The body of the request should be JSON like so:
{
  "assignment": {
    "muted": <true or false>
    ... any other params you feel like sending
  }
}

Change-Id: I699c23e032b25c369ef7319aebd97268947c7114
Reviewed-on: https://gerrit.instructure.com/174062
Tested-by: Jenkins
Reviewed-by: Gary Mei <gmei@instructure.com>
Reviewed-by: Keith Garner <kgarner@instructure.com>
QA-Review: Indira Pai <ipai@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2018-12-05 16:45:51 +00:00
James Williams 1885839ec2 don't truncate the seconds off of cached due dates
but still use the truncated one to compare to
grading periods

closes #COMMS-1796

Change-Id: Ibcbc160f374cfc32010799c67b58589c39e43b96
Reviewed-on: https://gerrit.instructure.com/174278
Tested-by: Jenkins
Reviewed-by: Steven Burnett <sburnett@instructure.com>
QA-Review: Steven Burnett <sburnett@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2018-12-05 15:59:55 +00:00
Nate Collings 77020a4d3f add allowed_attempts to assignments
Test Plan:

allowed_attempts:

* As a teacher in a course, set the "allowed_attempts"
  parameter to something for an assignment. Example curl:

curl -H "Authorization: Bearer <token>" \
  http://canvas-url.com/api/v1/courses/834/assignments/370 \
  -X PUT \
  -F "assignment[allowed_attempts]=10"

* Perform a GET request on that assignment to validate
  that it was set
* Validate that you can set allowed_attempts to values greater
  than 0 or -1
* Test a Course Copy and Course Import -- validate that the
  allowed_attempts come over when a course is copied

AssignmentExtensions:

* Validate that the submissions API now returns "extra_attempts"
* Test setting extra_attempts with the new AssignmentExtensions API.
  Example curl:

curl -H "Authorization: Bearer <api token>" \
 http://canvas-url.com/api/v1/courses/14/assignments/1/extensions \
 -X POST \
 -F "assignment_extensions[][user_id]=1" \
 -F "assignment_extensions[][extra_attempts]=10"

* Validate that you must have permissions to create assignments
  in a course in order to use this API
* Validate that extra_attempts can not be set to negative values

refs PFS-11440

Change-Id: I43a5b97d9d03df47ed3c15c4c59714b99c190921
Reviewed-on: https://gerrit.instructure.com/172569
Tested-by: Jenkins
QA-Review: Marisa Jense <mjense@instructure.com>
Product-Review: Bryce Stevenson <bstevenson@instructure.com>
Reviewed-by: Carl Kibler <ckibler@instructure.com>
2018-12-03 16:16:34 +00:00
Rex Fleischer 715d3cf10c log more information about what is happening for this error
Test-Plan:
N/A

refs: ADMIN-1573

Change-Id: I63e89be04aa0ded86470b7fefb3cc56d35c4992f
Reviewed-on: https://gerrit.instructure.com/172244
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Rex Fleischer <rfleischer@instructure.com>
Product-Review: Rex Fleischer <rfleischer@instructure.com>
2018-11-30 20:21:57 +00:00
wdransfield d74fc98d17 Do LtiDeepLinkingRequest message
Closes PLAT-4021

Test Plan:
- Install an LTI 1.3 tool that uses the editor_button
  placement.

  The tool's configuration should set the message
  type of each of this placements to 'LtiDeepLinkingRequest'
- Launch the tool from the RCE and verify
  * The 3rd party initiated OpenID auth flow occurs
  * The ID token contains all standard claims LTI claims
    (all claims a ResourceLinkRequest contains minus resourace_link_id
    related items)
  * Custom variables are supported and expanded
  * The deep linking settings claim is sent with all required
    values

Change-Id: I56ac0f708fb0afe7ffe515803f3fdb6f63f50d5b
Reviewed-on: https://gerrit.instructure.com/173385
Tested-by: Jenkins
Reviewed-by: Marc Phillips <mphillips@instructure.com>
QA-Review: Marc Phillips <mphillips@instructure.com>
Product-Review: Jesse Poulos <jpoulos@instructure.com>
2018-11-29 20:53:01 +00:00
Augusto Callejas 4d2bedefb3 LMGB outcome details includes all results
closes OUT-2550

test plan:
  - create more than 20 student users in a course.
    you can bulk create users by modifying the sample
    file of 10 users under "users.csv" on
    https://community.canvaslms.com/docs/DOC-12585-4214164118
    and then importing them through an account's SIS Import
    page (you may need to enable "SIS imports" on the account
    features section on its settings page).
    afterwards, add the students to a course
  - create a course outcome
  - create an assignment, aligned to the outcome using a rubric
  - as all the students, submit to the assignment
  - as a teacher, in SpeedGrader, create rubric assessments for
    all submissions, selecting different criterion ratings
  - load the LMGB page
  - hover over the outcome header, and confirm the outcome details
    summarize the correct percentages based on the outcome scores
  - navigate to the 2nd page of results
  - hover over the outcome header, and confirm the outcomes details,
    like described two steps above
  - enable the New Gradebook
  - repeat the steps above, starting at loading the LMGB page

Change-Id: I52815eb2e05a04a0ad70c9c53e13726dbc626b64
Reviewed-on: https://gerrit.instructure.com/173291
Tested-by: Jenkins
Reviewed-by: Neil Gupta <ngupta@instructure.com>
Reviewed-by: Frank Murphy III <fmurphy@instructure.com>
QA-Review: Brian Watson <bwatson@instructure.com>
Product-Review: Neil Gupta <ngupta@instructure.com>
2018-11-28 18:02:57 +00:00
Han Yan 956504e552 implement clean submission history for Quizzes.Next
closes QUIZ-5514

test plan:
The patch should be tested with /c/quiz_lti/+/170099/
QA live event path:
  These containers and their dependencies should be up running:
  - Canvas: web
  - quiz-lti: ui, api, kinesis2sqs-quizzes and sqs2quizlti
  - quiz-api: web, work (you can kill elasticsearch and events_consumer to
    save cpu and memory)

  test auto grading:
  create one Q.N quiz, with a couple questions and multiple attempts
  enabled (default highest), but without essay questions.
  1) As a student, take the quiz 3 times, there should be 3 history items
  in speedgrader history list

  test manual grading:
  create one Q.N quiz, with a number of questions, with at least 1 essay
  question and multiple attempts enabled.
  As a student, take the quiz 3 times
  1) make sure speedgrader history list has 3 records after 3 attempts are
  taken
  2) test manual grading on previous attempts in different order
  - manually grade the attempts in different order (1st attempt: 10%,
    3rd attempt: 80%, and 2nd: 50%)
  - make sure speedgrader has 3 history items, grades are corresponding to
    (10%, 50%, 80%), and in this order
  3) manual grading a same attempt won't add additional history items
  - manually change grade for the 1st attempt from 10% to 60%
  - make sure speedgrader still has 3 history items, grades are
    corresponding to (60%, 60%, 80%)
  - then manually change grade for the 1st attempt from 60% to 90%
  - make sure speedgrader still has 3 history items, grades in the list
    are (90%, 90%, 90%) and in the exact order

  test the similar steps for score_to_keep: average and latest

QA webhook path:
  These containers and their dependencies should be up running:
  - Canvas: web
  - quiz-lti: ui, api
  - quiz-api: web, work (you can kill elasticsearch and events_consumer
    to save cpu and memory)

  repeat the test cases for live event path.

Change-Id: I2e7ff4ea669ce2b84a95aa4f3ddf4a6f6c2a8002
Reviewed-on: https://gerrit.instructure.com/171695
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
Tested-by: Jenkins
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Kevin Dougherty III <jdougherty@instructure.com>
2018-11-28 15:41:17 +00:00
James Williams 77d6d56b5e raise error on missing feature
because clay can't spell

also get rid of that feature flag enabling on
every user in specs

also handle development features disabled in prod

Change-Id: Ifd6c590011e6963e7acea90f8f58bd2372123d26
Reviewed-on: https://gerrit.instructure.com/171781
Tested-by: Jenkins
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
QA-Review: Clay Diffrient <cdiffrient@instructure.com>
2018-11-26 16:22:32 +00:00
Jeremy Neander bade832f08 use bigdecimal for some grade calculator assertions
closes GRADE-1512

test plan:
 * Smoke test some grade calculations?

Change-Id: Ia26fe7fcb137dd1f5bc07bb77babf3694a268b70
Reviewed-on: https://gerrit.instructure.com/172851
Tested-by: Jenkins
Reviewed-by: Gary Mei <gmei@instructure.com>
Reviewed-by: Keith Garner <kgarner@instructure.com>
QA-Review: James Butters <jbutters@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2018-11-19 20:21:47 +00:00
Jeremy Neander e4c26d9ca6 spec: tighten grade calculator assertions
refs GRADE-1512

Type equality is relevant for grade calculations.

Change-Id: Ibb8fd67204ecbca592b2839fd71052d6d2a28ff8
Reviewed-on: https://gerrit.instructure.com/172707
Tested-by: Jenkins
Reviewed-by: Gary Mei <gmei@instructure.com>
QA-Review: Jeremy Neander <jneander@instructure.com>
Product-Review: Jeremy Neander <jneander@instructure.com>
2018-11-19 17:45:42 +00:00
Dan McCallum 08376d351e Include AGS claim in LTI 1.3 resource link launches
- LTI 1.3 launches now include an AGS claim
  (`https://purl.imsglobal.org/spec/lti-ags/claim/endpoint`)
  if the current tool's `DeveloperKey` has been granted
  any AGS scope.
  - If the launched link is an `Assignment`, the AGS claim will
  include a `lineitem` sub-claim set to the `Assignment`'s
  LTI Advantage `LineItem` API URL
  (`/api/lti/courses/:course_id/line_items/:line_item_id`).
  - In any AGS-enabled launch from from a `Course` or `Group`,
  the AGS claim will include `lineitems` sub-claim set the
  `Course`'s LTI Advantage `LineItem` collection API URL
  (`/api/lti/courses/:course_id/line_items`.)

Closes LTIA-49

Test Plan:

  1. Create an LTI 1.3 tool with at least one AGS scope granted to
  its `DeveloperKey`. Those scopes are:

- `https://purl.imsglobal.org/spec/lti-ags/scope/lineitem`
- `https://purl.imsglobal.org/spec/lti-ags/scope/lineitem.readonly`
- `https://purl.imsglobal.org/spec/lti-ags/scope/result.readonly`
- `https://purl.imsglobal.org/spec/lti-ags/scope/score`

  2. Launch the tool from a course navigation link.
  3. Verify that the
  `https://purl.imsglobal.org/spec/lti-ags/claim/endpoint` claim is
  present and:
    3.1. Sets all the granted scopes into the `scope` sub-claim
    3.2. Sets the `lineitems` sub-claim to
    `/api/lti/courses/:course_id/line_items`
    3.3. The `lineitem` sub-claim is not present.
  4. Bind the tool to an `Assignment` and launch from that
  `Assignment`.
  5. Verify that the
  `https://purl.imsglobal.org/spec/lti-ags/claim/endpoint` claim is
  present and:
    5.1. Sets all the granted scopes from step 1 into the `scope`
    sub-claim
    5.2. Sets the `lineitems` sub-claim to
    `/api/lti/courses/:course_id/line_items`
    5.3. Sets the `lineitem` sub-claim to
    `/api/lti/courses/:course_id/line_items/:line_item_id`
  To find :line_item_id for step 5.3 either use the console or database
  query. E.g. in the console:

`Assignment.find(Assignment.maximum(:id)).line_items.find(&:assignment_line_item?).id`

  6. Create another LTI 1.3 tool but do not grant any AGS scopes to its
  `DeveloperKey`.
  7. Launch the tool from a course navigation link.
  8. Verify that the
  `https://purl.imsglobal.org/spec/lti-ags/claim/endpoint` claim is
  not present.
  9. Bind the tool to an `Assignment` and launch from that
  `Assignment`.
  10. Verify that the
  `https://purl.imsglobal.org/spec/lti-ags/claim/endpoint` claim is
  not present.

Change-Id: I787d3e99c60993ed3d28ede08455617e601f3d30
Reviewed-on: https://gerrit.instructure.com/171345
Tested-by: Jenkins
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Product-Review: Marc Phillips <mphillips@instructure.com>
2018-11-14 16:43:17 +00:00
Cody Cutrer 14edde158d add effective_locale to a few API responses
closes CORE-1847

test plan:
 * have your user inheriting the default locale
 * go to /api/v1/users/self, /api/v1/users/self/profile. they should
   both have a non-null value for effective_locale, even though
   locale is null
 * to through the OAuth flow. notice that a value is provided
   for effective_locale in the user portion of the /token response

Change-Id: Ia8b5b555168db395fe15075d70b296c264a59d6d
Reviewed-on: https://gerrit.instructure.com/171446
Tested-by: Jenkins
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2018-11-14 05:34:57 +00:00
Andrew Huff 10cc439f18 Revert "fix display name url encoding in inst-fs"
refs RECNVS-322
refs RECNVS-756
refs ADMIN-1573

The previous commit fixed the problem with inst-fs (RECNVS-756)
but it broke other stuff; see ADMIN-1573 and
https://zach.beta.instructure.com/error_reports/500071076

We'll fix the inst-fs problem in an upcoming ticket to that project

This reverts commit 121e62f5d3.

Change-Id: I1cd01787052058751e7f57e599273c691e5b53e0
Reviewed-on: https://gerrit.instructure.com/172286
Tested-by: Jenkins
Reviewed-by: Jonathan Featherstone <jfeatherstone@instructure.com>
QA-Review: Andrew Huff <ahuff@instructure.com>
Product-Review: Andrew Huff <ahuff@instructure.com>
2018-11-14 04:16:22 +00:00
Dan McCallum 85fbec98f4 Remove LTI 1.1 Assignment claims from 1.3 launches
- Stop sending the following claims in LTI 1.3 Assignment launches:

1. https://www.instructure.com/lis_result_sourcedid
2. https://www.instructure.com/lis_outcome_service_url
3. https://www.instructure.com/ims_lis_basic_outcome_url
4. https://www.instructure.com/outcome_data_values_accepted
5. https://www.instructure.com/outcome_result_total_score_accepted
6. https://www.instructure.com/outcome_submission_submitted_at_accepted
7. https://www.instructure.com/outcomes_tool_placement_url

  - Following Assignment claims are still supported:

a. https://www.instructure.com/canvas_assignment_id (public tools only)
b. https://www.instructure.com/canvas_assignment_title
c. https://www.instructure.com/canvas_assignment_points_possible
d. https://www.instructure.com/content_return_types (hw submit only)
e. https://www.instructure.com/content_file_extensions (hw submit only)

  - Adjusted several existinfg negative tests to more explicitly verify
  that unsupported/suppressed claims are in fact completely absent from
  the launch request, not just set to `nil`.

Closes LTIA-50

Test Plan

  1. Launch a LTI 1.3 tool from an `Assignment`. Verify that claims 1-7
  listed above are _not_present. Verify that claims a - c *are*
  present. Verifying presence of d - e via the UI does not appear to be
  possible at this time, but is checked by rspecs.

Change-Id: I3f21664dd6aa597bb93e043a20e35631e0b13448
Reviewed-on: https://gerrit.instructure.com/170937
Tested-by: Jenkins
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Product-Review: Marc Phillips <mphillips@instructure.com>
2018-11-12 20:50:57 +00:00
Dan McCallum ecd0e98dea Launch LTI 1.3 tools with Assignment-derived resource link IDs
- Previously all LTI 1.3 launches set the context's identifier
  as the resource link ID. Now, when launching an `Assignment` bound
  to a LTI 1.3 tool, the `Assignment`s LTI identifier is set as the
  resource link ID. (Actually it's the LTI identifier associated with
  the `Assignment`'s `ResourceLink` for the launching tool.)
  - Any type of mismatch between the launching tool and the tool
  associated with the `Assignment` or its `ResourceLink` results in
  an error. As noted at bottom of the test plan, that the possibility
  for such errors even exists is rather likely to change in the
  future.

Closes LTIA-48

Test Plan:

  1. Create an LTI 1.3 `ContextExternalTool` and make it available to
  a `Course`. Be sure to include a course navigation placement config.
  2. Create an `Assignment` in that `Course` and bind it to the
  `ContextExternalTool` created in step 1.
  3. Launch the `Assignment`. Verify claim:

```
"https://purl.imsglobal.org/spec/lti/claim/resource_link": {
  "id": ${assignment.line_items.find(&:assignment_line_item?).resource_link.resource_link_id}
},
```

  4. Verify that the claim value in step 4 does _not_ match the
  `https://purl.imsglobal.org/spec/lti/claim/context` -> `id` claim
  (the latter should be the LTI ID for the `Course`).
  5. Launch the tool from course navigation.
  6. Verify that the
  `https://purl.imsglobal.org/spec/lti/claim/context` -> `id` claim
  has the same value it did in step 4.
  7. Verify that the
  `https://purl.imsglobal.org/spec/lti/claim/context` -> `id` and
  `https://purl.imsglobal.org/spec/lti/claim/resource_link` -> `id`
  claims match
  8. Re-bind the `Assignment` to a different LTI 1.3
  `ContextExternalTool`.
  9. Verify that launch attempts for the `Assignment` now fail
  with a `Lti::Ims::AdvantageErrors::InvalidLaunchError :: Mismatched
  assignment vs resource link tool configurations` message in error
  logs.

NB the last step is almost certainly incorrect long-term behavior, but
is consistent with the non-editability of `Assignment` `LineItem`s and
`ResourceLinks` from LTIA-47.

Change-Id: Ie5c63430082c4465a7d943343941f931c968ae11
Reviewed-on: https://gerrit.instructure.com/170818
Tested-by: Jenkins
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Marc Phillips <mphillips@instructure.com>
Product-Review: Marc Phillips <mphillips@instructure.com>
2018-11-09 21:27:51 +00:00
Keith T. Garner 061e538ba1 Revert "raise error on missing feature"
Looks like it broke for development feature flags when canvas was
running in production mode.

This reverts commit 974a6e809a.

Change-Id: I1946137a2c4fade435ca00fde75f2dcb3a795ac4
Reviewed-on: https://gerrit.instructure.com/171728
Reviewed-by: Jacob Burroughs <jburroughs@instructure.com>
Tested-by: Jenkins
QA-Review: Keith Garner <kgarner@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2018-11-08 22:59:23 +00:00